A fintech startup stores loan applications in S3 and Aurora PostgreSQL. Regulators require customer-managed encryption at rest, department-based least-privilege access to files and rows, and an auditable trail of who accessed sensitive objects. Which data protection design satisfies encryption, access control, and audit logging requirements?
Select an answer to reveal the explanation.
Short Explanation
You are locking each drawer with your own key and checking IDs. Customer keys plus tag-based rules and detailed trails give you control and proof, and ABAC keeps permissions tight as teams change.
Full Explanation
The correct design meets all three regulatory pillars because KMS customer managed keys provide customer-controlled at-rest encryption with key policy, rotation, and disablement for both S3 and Aurora, ABAC using IAM policies with department tags scales least privilege to S3 objects and to database access through tagged roles and IAM database authentication mapped to PostgreSQL row-level security without proliferating static roles, and CloudTrail data events record object-level API calls with identity, time, and resource so auditors can prove who accessed sensitive loan files. The default-encryption design fails on control because default S3 and Aurora encryption does encrypt data but relies on S3-managed or AWS managed keys that do not give the customer the key policy control, rotation ownership and revocation regulators require. The prefix-access design fails on granularity because S3 prefix permissions authorize file access by department but provide no row-level enforcement inside Aurora PostgreSQL where row-level security with session context is needed for least privilege. The monitoring-based design fails on accountability because GuardDuty findings and CloudWatch metrics detect anomalies but do not retain an immutable per-request identity trail for object reads. Exam caveat: distinguish detective monitoring from auditable logging and coarse network isolation from data-centric authorization when the stem explicitly demands files plus rows and customer-managed keys. Practical check: verify CMK ARNs on both bucket and cluster, test with two department principals to confirm cross-department denial including row queries, and query CloudTrail Lake for GetObject by user identity.