A healthcare startup stores patient records in S3 and RDS containing PHI across two Regions. HIPAA requires encryption at rest and in transit, least-privilege access with separation of duties, and immutable audit trails of every data access and key use. Which architecture meets these data protection requirements?
Select an answer to reveal the explanation.
Short Explanation
You've got sensitive patient data, so you'll want locks on every door plus a guest book that can't be erased. KMS keys with tight IAM roles and TLS handle the locks, while a validated CloudTrail trail in an Object Lock bucket plus S3 access logs gives you tamper-evident history tying access to key use.
Full Explanation
The correct design meets every stated control at once. KMS customer managed keys encrypt S3 and RDS at rest with auditable key use in each Region, scoped IAM roles enforce least privilege with separation between data, key and audit administration, and enforced TLS protects PHI in transit. A CloudTrail trail with data events and log file validation delivering to an S3 bucket with Object Lock gives immutable, verifiable records of management operations, KMS key use and object-level access, and S3 server access logs add request-level detail. The SSE-S3 design fails key-use auditability because S3-managed keys do not generate customer-visible KMS events in CloudTrail, so every key use cannot be tracked. The CloudWatch Logs design fails audit immutability and completeness because log groups can be edited or deleted and do not capture S3 object access by default. The shared admin design fails least privilege and separation of duties because one broad role can manage data, keys and trails, despite correct encryption and logging. For exams remember HIPAA-style questions require managed-key control, transit protection, scoped separation and immutable logging together. Practically validate KMS keys on S3 and RDS in both Regions, TLS enforcement, role scoping, and that a test read can be reconstructed from the trail with its Decrypt event.