Question

A financial services company is migrating a sensitive customer database to an IaaS provider's managed storage service. Regulatory requirements state that the organization must retain full control over the encryption keys used to protect the data at rest, including the ability to revoke access and rotate keys independently of the cloud provider. Which approach best satisfies this data security requirement?

Accepted Answer

Use customer-managed keys (CMK) generated and controlled by the organization in a key management service, with the option to bring your own key (BYOK)

Answer

Rely on the provider's default server-side encryption using provider-managed keys, since the data is already encrypted at rest

Answer

Enable TLS on all connections to the storage service to ensure the data is encrypted end to end

Answer

Apply IAM policies that restrict which users can access the storage bucket, eliminating the need for encryption key control