A bank must encrypt S3, EBS, and RDS with distinct department keys, enforce least-privilege use, audit every decryption, and rotate keys automatically without re-encrypting all data manually. Which encryption design meets centralized key control?
Select an answer to reveal the explanation.
Short Explanation
You're covered when you use a key for each department, scoped permissions, and full audit trails. Your setup is like an apartment building where tenants get their own locks while you keep the master office. With automatic rotation, you stay current without manually re-encrypting all your data.
Full Explanation
KMS customer managed keys meet the requirements by providing centralized control and department-level isolation for S3, EBS, and RDS envelope encryption. Automatic rotation preserves prior key versions, so existing data remains readable without bulk re-encryption; scoped grants and key policies limit Decrypt to required roles, and CloudTrail records every Decrypt call. A single central KMS key fails to provide department separation and blast-radius control, even though its rotation and logging are operationally sound. KMS keys with imported key material cannot use KMS automatic rotation and require manual re-import, so they do not provide hands-free rotation. S3 access logging records object requests, not KMS API activity, and therefore cannot prove every decryption; CloudTrail events for KMS are needed. For the exam, distinguish storage request logging from API auditing. In practice, verify that rotation is enabled on each key, the key policy permits only required principals, and a CloudTrail Lake query returns Decrypt events filtered by each department’s key ID.