A healthcare startup stores PHI in S3 and RDS, must enforce least privilege, encrypt data at rest and in transit, and prove who accessed which patient record and when for HIPAA audits. Developers use federated SSO and auditors need immutable evidence. Which architecture meets these data protection requirements?
Select an answer to reveal the explanation.
Short Explanation
Protecting health records means locking doors and keeping receipts. You'll encrypt everywhere, limit keys tightly, and record every peek in tamper-evident storage with audit logging. Auditors get a clean trail from request to record.
Full Explanation
IAM with KMS provides least-privilege access and envelope encryption for S3 and RDS, TLS enforces in-transit protection, and CloudTrail data events record who accessed which S3 object and when, and delivering them to an S3 bucket protected by S3 Object Lock (queryable with Athena) preserves tamper-proof evidence for HIPAA audits. Default encryption with VPC endpoints and GuardDuty findings improves network privacy and threat detection but lacks queryable access attribution and immutable audit retention. Cognito with ACM and Security Hub plus Config tracks identity and posture but does not provide API-level data-access audit trails. SSO permission sets with CloudHSM, WAF, and Detective address authentication and edge protection but miss centralized data-access logging and retention controls. Exam caveat: CloudTrail proves access activity, Config proves configuration history, GuardDuty finds threats. Practical check: enable an organization trail with S3 data events delivered to the Object Lock bucket, enforce KMS key policies, and validate Object Lock retention.