A health analytics SaaS stores each clinic's reports in one S3 bucket with separate prefixes, must isolate encryption per tenant for offboarding, retain central KMS audit, and block unencrypted uploads. Which encryption-at-rest design meets all three tenant-isolation requirements?
Select an answer to reveal the explanation.
Short Explanation
You're giving each clinic its own lock while you keep the master key ring. Per-tenant KMS keys let you revoke one clinic without touching others and leave a clean CloudTrail audit.
Full Explanation
S3 SSE-KMS with dedicated customer managed keys provides envelope encryption where S3 encrypts objects with data keys protected by the tenant-specific KMS key, giving cryptographic isolation, independent disable and revoke for offboarding, and central CloudTrail logging of every KMS use for audit, while a bucket policy condition on x-amz-server-side-encryption and key ARN blocks noncompliant uploads. SSE-S3 with AWS managed encryption fails by concept because it uses shared AWS managed keys with no per-tenant isolation or granular audit and cannot satisfy offboarding revocation. SSE-C with customer-supplied keys fails by concept because key management shifts to clients, losing central control, audit, and rotation, and adds operational risk for header handling. Dual-layer encryption with AWS managed keys and MFA Delete fails by concept because it improves durability and delete protection but still lacks per-tenant key separation and central KMS governance. Exam caveat: SSE-KMS with customer managed keys is the expected answer when per-tenant revocation plus audit is stated. Practical check: verify key policies, bucket policy conditions, and CloudTrail KMS events before onboarding tenants.