Question

A healthcare company stores patient records in a cloud provider's managed object storage. Compliance auditors require that even the cloud provider's own administrators and support staff be technically incapable of decrypting the data, and the company must retain full control over the encryption keys within their on-premises facility. Which approach best satisfies this requirement?

Accepted Answer

Encrypt the data client-side before upload using keys stored and controlled entirely in the company's on-premises key management system

Answer

Enable server-side encryption using provider-managed keys (SSE) and rely on the provider's access controls

Answer

Use the provider's default encryption at rest and restrict bucket policies to the company's IAM roles only

Answer

Enable customer-managed keys (CMK) in the provider's key management service with automatic rotation