Question

A healthcare company runs a real-time SageMaker endpoint that serves patient risk scores. Compliance requires that all inference request and response payloads captured to Amazon S3 be encrypted with a customer-managed KMS key, and that data captured from this specific endpoint can be cryptographically distinguished from data captured by other endpoints in audit logs. The security team also wants CloudTrail records to show which endpoint triggered each KMS decrypt operation without decrypting the data itself. What is the MOST appropriate way to meet these requirements?

Accepted Answer

Enable data capture with a customer-managed KMS key and configure the endpoint's data capture to use an encryption context keyed on the endpoint name, so KMS grants and CloudTrail logs record the context per endpoint.

Answer

Enable data capture with SSE-S3 (S3-managed keys) and add an S3 bucket policy that tags objects with the endpoint name for auditability.

Answer

Disable data capture and instead stream inference payloads to CloudWatch Logs, relying on CloudWatch Logs default encryption for compliance.

Answer

Enable data capture with a single customer-managed KMS key shared across all endpoints and rely on the S3 object prefix to distinguish endpoints in audit logs.