Key Custody and Cross-Region DR for PII
A health-tech SaaS company stores PII in DynamoDB and S3 in us-east-1, with disaster recovery in us-west-2. It uses one AWS KMS customer-managed key per region. The key policy grants key administration to a broad platform-admin IAM role, and the same key encrypts all tenants' data. A new enterprise customer requires tenant-specific key custody, annual rotation with evidence, and the ability to revoke one tenant's access without affecting other tenants. The DR design replicates S3 objects to us-west-2, but the team has not tested restoring encrypted DynamoDB backups in the DR region. An analytics team in another account needs read-only access to de-identified data. The company has 18 months of CloudTrail key-usage logs but no automated review. The security architect must propose a key hierarchy and operational model. The customer's contract includes a right-to-audit clause and a 72-hour notification requirement for key-policy changes.
1. Propose a key hierarchy that supports per-tenant custody, annual rotation, and revocation. Explain what is encrypted by what and where keys live.
Read the worked answer
Use envelope encryption with a per-tenant KMS customer-managed key in each active region. The application calls kms:GenerateDataKey with the tenant key, uses the plaintext data key to encrypt the object or DynamoDB item, and stores the encrypted data key alongside the ciphertext. The tenant key never leaves KMS. Separate key administration from key usage: a central key-admin role can manage policy but cannot decrypt; tenant application roles get kms:Decrypt and kms:GenerateDataKey through grants or narrowly scoped key policies.
For DR, use KMS multi-region keys if the tenant key must decrypt replicas in us-west-2, or re-encrypt replicated objects with a destination-region tenant key. Annual rotation should use KMS automatic rotation for the CMK and record the rotation date; old backing keys remain available for decrypt. Revocation is the hard part: disabling the tenant key blocks new decrypts, but any cached plaintext data key remains usable until discarded. Document that application caching must be bounded, and revoke grants as well as disabling the key. Test revocation per tenant before promising it.
2. The analytics team in another account needs de-identified data. How do you grant access without broadening the tenant keys or exposing PII?
Read the worked answer
Do not grant the analytics account access to tenant keys. Create a separate de-identification pipeline in the producer account that reads tenant data, removes or generalizes identifiers according to a defined standard, and writes the result to a dedicated analytics bucket encrypted with a separate analytics key. Grant the analytics account a cross-account role with read-only access to that bucket and kms:Decrypt only on the analytics key. Use a bucket policy that allows the role ARN and denies access outside the approved VPC or IP range.
This keeps tenant key policies small and auditable. Run IAM Access Analyzer and review the role after 30 days. If the analytics team needs to join datasets, provide a clean room or a separate project account rather than expanding the tenant key policy. The judgement is to move the data to a lower-sensitivity key domain instead of lowering the protection around the original data.
3. What must be tested for DR restore of encrypted DynamoDB backups, and what key-policy changes require customer notification?
Read the worked answer
Test restore in us-west-2, not just backup completion. Confirm that the DR role can use the destination-region key, restore the table, and have the application decrypt records. Measure restore time and verify point-in-time recovery. If using multi-region keys, show that the replica key has the same key ID and that kms:Decrypt works after failover. If not, document the re-encryption step and its time cost. Repeat quarterly and keep the test record.
Notify the customer within 72 hours for changes that reduce their ability to decrypt, expand administrative access to their tenant key, change key custody or region, or disable or schedule deletion of a tenant key. Routine automatic rotation does not normally require notification, but the contract language controls. Maintain a key-policy change log with reviewer, date, and customer-impact assessment so the right-to-audit clause can be satisfied.