The city requires customer-controlled keys and audit of key use for a DynamoDB table of sealed case indexes. Do AWS owned keys meet that bar?
Select an answer to reveal the explanation.
Short Explanation
AWS owned keys are the default hotel safe—AWS holds the combination. A city that wants its own tumblers and CloudTrail key-use receipts needs a customer managed CMK on the DynamoDB table. VPC endpoints do not replace encryption key ownership.
Full Explanation
When the city requires customer-controlled keys and auditable key use for a DynamoDB table of sealed case indexes, use a customer managed CMK with SSE-KMS. CMKs give the city key-policy control, the ability to disable or revoke, and CloudTrail visibility into KMS API usage. AWS owned keys encrypt data but do not provide that customer key-policy and audit bar the stem describes.
Claiming AWS owned keys always give the city full key-policy control and identical CloudTrail Decrypt detail to CMKs overstates their customer control. DynamoDB can use CMKs via SSE-KMS; saying only AWS owned keys are supported is false. Disabling table encryption and relying on VPC endpoints alone does not provide key control or at-rest encryption.
Exam caveat: enabling a CMK also means planning grants/permissions for application roles and understanding that key disablement breaks reads/writes for ciphertext under that key. Operational check: create or update the table with SSE-KMS CMK, put and get an item successfully, inspect CloudTrail for KMS events tied to table access, and confirm the key policy is owned and reviewable by the city’s security team. For municipal workloads, document the chosen pattern in the runbook so the next on-call engineer applies the same control instead of inventing a weaker shortcut under pressure.