A courts system must encrypt case files at rest so cryptographic ke…

Question

A courts system must encrypt case files at rest so cryptographic key control remains with the justice AWS account rather than depending only on default keys owned by a shared security account. Which encryption strategy best meets this ownership requirement?

Accepted Answer

Create customer managed KMS keys in the justice account, define key policies that allow required court principals and approved cross-account roles, and configure storage services to use those justice-owned keys. — If justice must hold the keys to the evidence room, mint customer managed KMS keys in the justice account and point S3 or disks at those keys. Borrowing only someone else's defaults—or skipping encryption—does not meet ownership requirements.

Answer

Use only AWS owned keys with no customer key policy controls so the justice account never manages keys.

Answer

Store case files unencrypted and rely on VPC isolation as the sole confidentiality control.

Answer

Share the security account's root credentials with court admins so they can use that account's default keys.

A courts system must encrypt case files at rest so cryptographic key control remains with the justice AWS account rather than depending only on default keys owned by a shared security account. Which encryption strategy best meets this ownership requirement?

Short Explanation

Full Explanation