Question

A financial services company must comply with a regulation that requires them to retain full control over the cryptographic key material used to encrypt sensitive data stored in Amazon S3. Their compliance policy mandates that the key material be generated in their on-premises hardware security module (HSM) and that they retain the ability to permanently delete the key material from AWS on demand. A CloudOps engineer must configure AWS KMS to meet these requirements. Which approach should the engineer take?

Accepted Answer

Create an AWS KMS key with imported key material (external origin), generate the key material in the on-premises HSM, and import it with an expiration date so the material can be deleted from AWS while the company retains the original copy.

Answer

Create an AWS managed KMS key and enable automatic annual key rotation to satisfy the requirement for company-controlled key material.

Answer

Create an AWS KMS key backed by an AWS CloudHSM cluster and rely on AWS to generate and manage the key material within the cluster.

Answer

Create a customer managed KMS key with AWS-generated key material and use a key policy that restricts decryption to the company's IAM principals.