Question

A financial services company must retain full control over the cryptographic key material used to encrypt data stored in a cloud provider's managed key service, per regulatory requirements. Auditors require that the company generate the key material on-premises and be able to revoke the provider's ability to use it at any time. Which approach best meets these requirements?

Accepted Answer

Use Bring Your Own Key (BYOK) to import externally generated key material into the cloud KMS, retaining the original copy on-premises for re-import or revocation

Answer

Enable automatic key rotation on a provider-managed key and store the rotation schedule in a compliance document

Answer

Use the provider's default service-managed encryption keys and rely on the shared responsibility model for compliance

Answer

Encrypt data client-side with a symmetric key and disable server-side encryption on the storage service entirely