Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is deploying a new web application on Amazon EC2 instances. The application requires access to a database password and must encrypt configuration files at rest using an AWS Key Management Service (AWS KMS) customer managed key (CMK). The security team requires that the database password be stored securely, the CMK automatically rotate every year, and historical files encrypted with the CMK remain decryptable without manual key management or re-encryption. Which configuration meets these requirements with the least operational overhead?

  1. Store the database password in AWS Secrets Manager. Enable automatic rotation on the KMS customer managed key (CMK).Answer
  2. B
    Store the database password as a String parameter in AWS Systems Manager Parameter Store. Enable automatic rotation on the KMS customer managed key (CMK), and write a script to re-encrypt all historical files with the new backing key after rotation.
  3. C
    Store the database password in AWS Secrets Manager. Use the AWS account root user to manually delete the previous backing key version after rotation to ensure only the newest backing key is active.
  4. D
    Store the database password in AWS Systems Manager Parameter Store as a SecureString. Disable automatic key rotation, manually create a new customer managed key (CMK) each year, delete the old CMK, and update the application configuration with the new CMK ARN.

Answer

Store the database password in AWS Secrets Manager, and enable automatic rotation on the KMS customer managed key (CMK).
Storing the database password in AWS Secrets Manager satisfies the requirement for secure credential storage. Enabling automatic key rotation on the KMS customer managed key (CMK) automatically creates a new backing key every year while preserving the previous backing key versions. This allows the application to seamlessly decrypt older files without manual intervention, script execution, or code changes.

Step-by-Step Solution

1
Select a secure storage mechanism for the database password.
AWS Secrets Manager is selected to securely store the database password.
Secrets Manager encrypts secrets at rest and supports automatic rotation, unlike standard String parameters in Systems Manager Parameter Store which store secrets in plaintext.
2
Configure key rotation for the customer managed key (CMK).
Enable automatic key rotation for the KMS CMK.
Enabling automatic key rotation provides hands-off key management where AWS KMS generates a new backing key every year.
3
Evaluate decryption requirements for historical data.
Confirm that KMS transparently retains previous backing key versions.
When automatic key rotation is enabled, AWS KMS keeps all older backing key versions active for decryption. There is no need to re-encrypt old data or update application code with new CMK ARNs.

Key Concept

AWS KMS Automatic Key Rotation and Secrets Management
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic