CedarHealth requires control over encryption keys for a supported managed data service. It also needs recovery copies to remain usable. Which key-management plan is appropriate?

1. Store a database password in a document and call it an encryption key policy.
2. Assume disabling the key has no effect because the data is replicated.
3. Use supported CMEK and govern permissions, key versions, availability, and recovery dependencies.
4. Destroy every previous key version immediately after rotation.