The CMK vs AWS-managed key trap in HIPAA S3

AWS-managed KMS keys can't be revoked by the customer. During a breach, that means you can't render encrypted PHI unreadable. Here's why HIPAA demands a CMK.