✓ Human-authored analysis; AI used for formatting and proofreading. "Which KMS key should I use for PHI in S3? We're using the default aws/s3 managed key. Our auditor is asking about key management but SSE-KMS is SSE-KMS, right?" Wrong. The difference between an AWS-managed key and a customer-managed key (CMK) is the difference between having and not having a breach containment option. What most teams get wrong S3 offers three encryption options: SSE-S3 (AES...