A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for…

This solution directly addresses the need for immutable audit evidence. AWS CloudTrail is the designated service for logging API calls, including all management and data events for AWS KMS such as key creation (CreateKey) and usage (Sign). Enabling CloudTrail log file validation provides cryptographic verification that log files have not been altered. Storing these validated logs in an Amazon S3 bucket with S3 Object Lock in compliance mode ensures the logs are stored in a Write-Once-Read-Many (WORM) model, making them immutable for a specified retention period. This combination provides a robust, tamper-evident, and unchangeable record suitable for compliance and auditing purposes.

B. Amazon CloudWatch Logs does not natively provide the WORM immutability required for stringent compliance evidence; logs can be deleted unless specific, complex configurations are made.

C. Storing events in DynamoDB does not meet the immutability requirement, as records in a DynamoDB table can be updated or deleted by users with appropriate permissions.

D. CloudWatch metrics provide aggregated, numerical data about KMS usage, not the detailed, unalterable event logs required for a forensic audit of specific API calls.

1. AWS KMS Developer Guide: "Logging AWS KMS API calls with AWS CloudTrail" - This document explicitly states, "AWS KMS is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in AWS KMS." It details the specific events logged, such as CreateKey and Sign.

2. Amazon S3 User Guide: "Using S3 Object Lock" - Section "How S3 Object Lock works" explains that Object Lock can help meet regulatory requirements that require WORM storage. It states, "S3 Object Lock provides two retention modes: governance mode and compliance mode." Compliance mode ensures an object version cannot be overwritten or deleted by any user, including the root user.

3. AWS CloudTrail User Guide: "Validating CloudTrail log file integrity" - This page describes the feature: "To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation." This directly supports the need for verifiable evidence.

4. AWS Whitepaper: "Security at the Edge: Core Principles" - While discussing logging and monitoring, patterns involving CloudTrail for API activity and S3 for durable, secure log storage are presented as foundational security practices. The combination of CloudTrail and S3 is a standard pattern for audit trails. (Reference to general security principles).