A payment processor must encrypt cardholder data in Aurora and S3 with distinct keys per environment, annual rotation, and immediate revocation on breach, while meeting PCI DSS key management evidence needs. Which data-at-rest encryption design satisfies these strict key lifecycle requirements?
Select an answer to reveal the explanation.
Short Explanation
Sharing one house key across apartments is a breach waiting to happen. Per-environment customer managed keys give you rotation and kill-switch control.
Full Explanation
The correct design succeeds because per-environment customer managed keys provide isolation for Aurora and S3, automatic annual rotation enforces the strict lifecycle without drift, scoped IAM enables least privilege and immediate disablement of only the affected environment on breach, and CloudTrail supplies tamper-evident evidence of key creation, use, rotation and revocation demanded by PCI DSS. The AWS managed keys design fails on control and isolation because those keys are service-owned, cannot enforce customer-defined per-environment separation, and cannot be directly managed for rapid disablement and audit-ready lifecycle proof. The manual-rotation design fails on lifecycle assurance because human-initiated rotation upon review risks missed cycles and auditor findings, lacking the enforced guarantee of automatic annual rotation. The metrics-monitoring design fails on evidence because CloudWatch tracks operational health but does not record who performed which key operation and when, so without CloudTrail there is no non-repudiable audit trail. As an exam caveat, do not equate encryption at rest or monitoring with compliant key management; focus on rotation mode, key scope and auditable control. As a practical check, verify each environment has its own CMK with rotation enabled, key and IAM policies enforce separation, CloudTrail is multi-Region with integrity validation, and rehearse disable and re-encryption runbooks.