A healthcare SaaS stores PHI in S3 and EBS for 200 clinics and must enforce customer managed keys per tenant, with annual rotation without re-encrypting data and centralized audit of key use. Which encryption-at-rest design with automatic rotation satisfies the tenant isolation requirement?

Per-tenant AWS KMS customer managed keys provide a distinct key and independent lifecycle and revocation for each clinic’s PHI. Native automatic rotation preserves prior key versions, so S3 objects and EBS volumes remain decryptable without re-encrypting data. Key policies can limit each key to its tenant; bucket policies requiring SSE-KMS and EBS encryption using the tenant’s key enforce its use, while CloudTrail records Decrypt and GenerateDataKey activity for centralized audit. An organization-wide key with tenant-specific aliases fails the isolation requirement: aliases point to the same key, so ABAC and prefixes may separate authorization, but compromise, revocation, or rotation affects all tenants rather than giving each one a distinct key. Per-tenant keys audited through CloudWatch metrics fail the audit requirement because metrics summarize volume and throttling but lack authenticated identity, request parameters, and immutable history; centralized CloudTrail records who used which key and when. Per-tenant keys with annually imported material fail the automatic-rotation requirement because externally supplied material does not support automatic rotation and requires scheduled manual re-import, increasing the burden across 200 tenants and risking expiration or outage. Exam caveat: aliases do not create distinct per-tenant keys, even when paired with ABAC. Practical check: verify each tenant maps to a unique CMK ARN with rotation enabled, confirm unencrypted S3 puts and EBS volumes are denied, and query the centralized log store for key ID and principal.