A regional clinic migrates patient records to Amazon RDS for PostgreSQL and Amazon S3. Compliance requires encryption at rest with customer-controlled keys, annual rotation without re-encrypting data, and separate audit of key use in CloudTrail. Which encryption control meets the data-at-rest requirement?
Select an answer to reveal the explanation.
Short Explanation
You've got strict key ownership rules here, so reach for your own keys. Customer managed keys give you rotation and CloudTrail audit like a hotel master-key log.
Full Explanation
Envelope encryption with a customer managed KMS key satisfies all three stated needs because S3 and RDS request a unique data key from KMS for each object or storage volume, the customer managed key itself never leaves KMS and rotation creates new key material while retaining old material to decrypt prior data keys, and every Encrypt, Decrypt, and GenerateDataKey call is logged to CloudTrail with the key ARN for audit. SSE-S3 with S3 managed keys fails by concept because AWS owns rotation and the key, so the customer cannot control rotation policy or isolate key-use audit to their own key. Client-side encryption with stored data keys fails by concept because the customer must build secure key storage, distribution, and rotation for every client, increasing risk and losing centralized CloudTrail key-use visibility that KMS provides. TLS with ACM certificates fails by concept because it protects data in transit between clients and S3 or RDS, not data persisted on disks, snapshots, or backups that compliance scopes as at rest. For the exam, remember SSE-KMS versus SSE-S3 hinges on key control and audit, and in practice verify the bucket default encryption, RDS storageEncrypted flag, and key policy grants before loading PHI.