How do you implement this in a highly available and cos…

You are designing a personal document-archiving solution for your global enterprise with thousands of
employee. Each employee has potentially gigabytes of data to be backed up in this archiving solution. The
solution will be exposed to the employees as an application, where they can just drag and drop their files to the
archiving system. Employees can retrieve their archives through a web interface. The corporate network has
high bandwidth AWS Direct Connect connectivity to AWS.
You have a regulatory requirement that all data needs to be encrypted before being uploaded to the cloud.
How do you implement this in a highly available and cost-efficient way?

A.
Manage encryption keys on-premises in an encrypted relational database. Set up an on-premises server
with sufficient storage to temporarily store files, and then upload them to Amazon S3, providing a client-side
master key.

B.
Mange encryption keys in a Hardware Security Module (HSM) appliance on-premises serve r with sufficient
storage to temporarily store, encrypt, and upload files directly into Amazon Glacier.

C.
Manage encryption keys in Amazon Key Management Service (KMS), upload to Amazon Simple Storage
Service (S3) with client-side encryption using a KMS customer master key ID, and configure Amazon S3
lifecycle policies to store each object using the Amazon Glacier storage tier.

D.
Manage encryption keys in an AWS CloudHSM appliance. Encrypt files prior to uploading on the employee
desktop, and then upload directly into Amazon Glacier.