A county records archive in Amazon S3 must be encrypted at rest with customer managed KMS keys, and key usage must be auditable. Which design best satisfies those controls?
Select an answer to reveal the explanation.
Short Explanation
County records need a named key you control—SSE-KMS with a CMK—and CloudTrail is the guestbook showing who borrowed that key. Checksums and naked EBS volumes do not give you audited encryption at rest.
Full Explanation
County records archives in Amazon S3 that require encryption at rest with customer managed keys and auditable key use should enable SSE-KMS using a customer managed CMK on the bucket (default encryption and/or bucket policy denies of unencrypted puts) and rely on AWS CloudTrail to capture KMS Encrypt, Decrypt, GenerateDataKey, and related events. A CMK gives the municipality ownership of key policy, rotation settings, and grant hygiene, while CloudTrail provides the guestbook of which principal used the key—exactly the confidentiality-plus-accountability pairing auditors expect for records retention systems.
Leaving objects unencrypted and citing VPC Flow Logs as proof of confidentiality fails by concept: Flow Logs show network metadata, not object encryption or key custody. Using only client-visible MD5 checksums without server-side encryption and disabling CloudTrail fails both encryption and auditability; checksums detect accidental corruption, not unauthorized reads, and without CloudTrail key use is invisible. Storing the archive on an unencrypted EBS volume attached to a public EC2 instance fails durability architecture and exposure control—block volumes are not an S3 records archive, and public instances widen the blast radius.
Exam caveat: SSE-KMS alone is incomplete if the bucket policy still allows public reads or overly broad kms:Decrypt; pair encryption with least-privilege IAM and Block Public Access. Operational check: put a test object, confirm x-amz-server-side-encryption is aws:kms with the expected CMK, deny a role lacking kms:Decrypt, and locate corresponding KMS events in CloudTrail for the successful and denied attempts.