A genomics startup stores 20 TB of sequencing data in S3 and RDS snapshots, subject to HIPAA and customer-managed key rotation with per-project key isolation and audit of every decrypt call. The team wants envelope encryption without managing key storage. Which data-at-rest encryption design should the architect implement to meet isolation and auditability mandates?
Select an answer to reveal the explanation.
Short Explanation
Sensitive data deserves its own keys and receipts for every use. Separate KMS customer keys per project give you isolation plus CloudTrail proof. Envelope encryption handles the heavy lifting securely.
Full Explanation
The correct design succeeds because distinct KMS customer managed keys per project applied via S3 bucket and RDS encryption defaults deliver envelope encryption without storing key material, since KMS creates and protects data keys, while per-project keys enable isolated rotation, revocation, and least-privilege policies and every decrypt produces a CloudTrail KMS event for HIPAA auditing. A shared single customer managed key with rotation and logging looks efficient and auditable but violates per-project isolation, since one key serves all projects so compromise or disablement impacts every dataset and usage cannot be attributed per project boundary. Separate AWS managed keys per project provide isolation and defaults but miss customer control, because rotation, policy, and deactivation remain under AWS management rather than customer-managed rotation mandates. Caching data keys locally while using distinct customer managed keys improves performance but defeats audit of every decrypt call, because reused data keys bypass KMS and leave no fresh CloudTrail record despite actual data access. On exams watch for AWS managed versus customer managed wording and any feature that reduces KMS calls when full auditing is required. In practice confirm bucket defaults, RDS encryption, distinct key ARNs, rotation status, and generate a test read to observe the expected decrypt log.