Question

A data engineering team stores sensitive customer records in an S3 bucket encrypted with a customer managed AWS KMS key (SSE-KMS). A new compliance mandate requires that the encryption key material be rotated automatically every year and that all decryption operations against the key be logged for audit purposes. The team must implement this with the least operational overhead. Which combination of actions meets these requirements?

Accepted Answer

Enable automatic key rotation on the customer managed KMS key and use AWS CloudTrail to capture KMS API events such as Decrypt and GenerateDataKey.

Answer

Manually create a new KMS key each year, re-encrypt all objects, and query the KMS key metadata through the AWS CLI to review usage.

Answer

Switch the bucket to SSE-S3 (Amazon S3 managed keys) and enable S3 server access logging to capture encryption activity.

Answer

Enable automatic key rotation on an AWS managed KMS key and rely on Amazon Macie to log all decryption calls.