A courts system must encrypt case files at rest so cryptographic key control remains with the justice AWS account rather than depending only on default keys owned by a shared security account. Which encryption strategy best meets this ownership requirement?
Select an answer to reveal the explanation.
Short Explanation
If justice must hold the keys to the evidence room, mint customer managed KMS keys in the justice account and point S3 or disks at those keys. Borrowing only someone else's defaults—or skipping encryption—does not meet ownership requirements.
Full Explanation
Case-file encryption that must keep cryptographic key control in the justice AWS account calls for customer managed KMS keys created in that account. Key policies grant court principals and approved cross-account roles the precise kms:Encrypt, Decrypt, and related actions they need, while storage services (S3, EBS, RDS, and so on) are configured to use those justice-owned CMKs. Default AWS owned keys or keys owned only by a shared security account would leave the justice account without the key-policy ownership the requirement demands.
Using only AWS owned keys with no customer key policy controls means the justice account cannot define who may use or administer the keys. Storing case files unencrypted and relying on VPC isolation alone ignores encryption-at-rest obligations for sensitive court data. Sharing the security account’s root credentials so court admins can “use that account’s default keys” is a catastrophic identity anti-pattern and still fails justice-account key ownership.
Exam caveat: distinguish AWS owned keys, AWS managed keys, and customer managed keys; ownership and key-policy control for regulated municipal data usually point to CMKs in the workload or data-owner account. Operational check: create the CMK in the justice account, attach a least-privilege key policy, point the case-file bucket or database at that CMK, prove a non-approved role cannot decrypt, and enable automatic rotation where the key type supports it.