Which strategy is the MOST operationally efficient for the company to use to meet these requirements?
Create a customer managed CMK in the logging account. Update the CMK key policy to provide access to the logging account only. Manually rotate the CMK every 365 days.
Create a customer managed CMK in the logging account. Update the CMK key policy to provide access to the logging account and business unit accounts. Enable automatic rotation of the CMK.
Use an AWS managed CMK in the logging account. Update the CMK key policy to provide access to the logging account and business unit accounts. Manually rotate the CMK every 365 days.
Use an AWS managed CMK in the logging account. Update the CMK key policy to provide access to the logging account only. Enable automatic rotation of the CMK.
Explanations:
This option involves creating a customer managed CMK but restricts access to the logging account only. While it meets the encryption requirement, it does not allow the business units to write logs, as they need access to the CMK. Additionally, manual rotation every 365 days is less operationally efficient compared to automatic rotation.
This option creates a customer managed CMK with access granted to both the logging account and the business unit accounts. It allows all units to write logs while enabling automatic rotation of the CMK, which aligns with the requirement for operational efficiency and reduces the manual workload associated with key management.
This option uses an AWS managed CMK, which does not allow for custom key policies and does not provide the control necessary to grant access to specific accounts. It also requires manual rotation every 365 days, which is not as efficient as automatic rotation, making it a poor choice for the requirement.
While this option uses an AWS managed CMK, which simplifies management, it restricts access to the logging account only. The business units would not be able to encrypt their logs as they lack access to the key. Enabling automatic rotation is positive, but without the necessary access, it fails to meet the requirement.
Based on what I know, the answer is:
Create a customer managed CMK in the logging account. Update the CMK key policy to provide access to the logging account and business unit accounts. Enable automatic rotation of the CMK.