A healthcare startup stores patient records in S3 and RDS and must enforce distinct KMS keys per environment, automatic key rotation, and auditable decryption denials for HIPAA. Operations wants no application code changes for encryption handling. Which at-rest encryption design satisfies the regulatory isolation and auditability requirement?
Select an answer to reveal the explanation.
Short Explanation
You want separation without rewriting code. Per-environment SSE-KMS gives you rotation, isolation, and CloudTrail proof with zero app surgery.
Full Explanation
The correct design works because SSE-KMS keeps encryption transparent to S3 and RDS while separate customer managed keys give per-environment isolation via distinct policies that block cross-environment decryption, automatic rotation replaces backing material annually without re-encrypting objects, and KMS denials and data-key calls emit CloudTrail events with key ARN and context for HIPAA auditability, requiring only bucket and storage encryption configuration with no code change. The variant with separate AWS managed keys and automatic rotation fails on ownership because AWS managed keys are created one per account, Region, and service, so they cannot be split per environment, cannot carry custom per-environment policies or provide the same attestation granularity, so regulatory isolation is lost despite transparent operation. The variant with separate customer managed keys for S3 and RDS but no rotation fails on lifecycle because customer managed keys rotate only when enabled, leaving long-lived material that violates automatic rotation even though isolation and transparency remain. The client-side design with separate rotated customer managed keys fails on operations because encryption moves into libraries and key providers that must be coded, deployed and maintained per service, violating no code changes despite strong control. Exam caveat is to anchor each requirement to a KMS attribute instead of selecting any encryption that sounds secure, especially managed versus customer managed and server-side versus client-side. Practical check is to describe keys per environment to confirm rotation enabled, verify S3 defaults and RDS instances reference the correct ARN, then test with an unauthorized role and confirm CloudTrail records KMS AccessDenied with key context.