Question

A financial services company must migrate encryption for a regulated SaaS workload to a public cloud provider. Compliance requires that the organization retain sole control over the origin of the key material and be able to demonstrate to auditors that the cloud provider never generated the master key. The team wants to use the provider's managed KMS for performance but must satisfy this key-provenance requirement. Which approach best meets the requirement?

Accepted Answer

Use Bring Your Own Key (BYOK): generate the key material in the on-premises HSM, wrap it with the KMS public wrapping key, and import it into the cloud KMS

Answer

Enable the cloud KMS default key generation and rotate keys automatically every 90 days

Answer

Store customer-managed keys in the cloud KMS but enable audit logging to prove the provider did not misuse them

Answer

Use Hold Your Own Key (HYOK) by keeping all keys on-premises and forwarding every encrypt/decrypt call over the internet to the on-premises HSM