What capabilities does the cloud provider have to rotate keys on an automatic or semi-automatic basis?
What support does the cloud provider have for an enterprise re-key scenario?
Do logs record all activity in the cloud environment from the cloud provider’s perspective?