Use customer-managed keys (CMK) for encryption at rest to maintain full control over key lifecycle, rotation, and revocation — required for highly regulated environments such as HIPAA and PCI-DSS