An application uses Amazon RDS for MySQL. A compliance mandate requires the encryption key to live in hardware the company physically controls and that AWS personnel cannot access. Which solution satisfies this?
Show answer and explanation
Answer: C
CloudHSM provides single-tenant HSM clusters that only the customer administers, so AWS operators have no access to the key material inside them. A KMS custom key store backed by CloudHSM lets RDS encryption use a CMK whose key material resides in that customer-controlled hardware, combining managed RDS encryption with exclusive customer possession of the keys.
Every ordinary KMS option — AWS-managed or standard customer-managed — keeps keys in HSM clusters that AWS itself operates, which does not meet the physical-control mandate.
Why the other options are wrong
- A. The aws/rds managed key is entirely under AWS control in AWS-operated HSMs, giving the company neither possession of nor access control over the key hardware.
- B. A standard customer-managed CMK improves control over policies and rotation, but the key material still resides in multi-tenant HSMs that AWS operates and can access, so the physical-control requirement fails.
- D. Application-layer encryption leaves the key wherever the application runs, with no validated HSM boundary and no managed key lifecycle, which does not satisfy the hardware-control requirement.