Question

A financial services company must meet a regulatory requirement that all cryptographic key material used to encrypt customer data at rest be stored in single-tenant, FIPS 140-2 Level 3 validated hardware that the company controls, while still using AWS KMS APIs for envelope encryption across services such as S3 and EBS. Which approach satisfies this requirement with the least custom integration effort?

Accepted Answer

Create a KMS custom key store backed by an AWS CloudHSM cluster and generate KMS keys within that key store.

Answer

Import your own key material into a standard AWS-managed KMS key using the BYOK import feature.

Answer

Use AWS KMS multi-Region keys so key material is replicated to hardware in each Region the company operates in.

Answer

Enable automatic annual key rotation on a standard KMS symmetric key to satisfy the hardware isolation requirement.