It uses the GenerateDataKey API against a single master key. At the client side, yes, could send an SNS notification, or otherwise go indirectly via a Lambda.

It uses the GenerateDataKey API against a single master key. At the client side, yes, could send an SNS notification, or otherwise go indirectly via a Lambda. Or, alternatively, stream CloudTrail logs through Lambda to achieve a similar result.