Question

A financial services company must store the root encryption keys for its payment processing platform in the cloud. Regulatory auditors require that the keys never leave a FIPS 140-2 Level 3 validated hardware boundary and that the cloud provider itself has no ability to access or export the key material. Which key management approach should the cloud engineer implement?

Accepted Answer

Use a dedicated cloud HSM (single-tenant hardware security module) that provides FIPS 140-2 Level 3 validation and customer-controlled key material with no provider access

Answer

Use the provider's standard multi-tenant KMS with provider-managed keys and enable automatic rotation

Answer

Store the keys in a secrets manager encrypted with a customer-managed KMS key and restrict access with IAM policies

Answer

Encrypt the keys with a passphrase and store them in an object storage bucket with server-side encryption enabled