Examkin

Question

Difficulty: EasyData Encryption and Key Management

A financial services application runs on Amazon EC2 instances with attached Amazon EBS volumes that contain highly sensitive transaction records. The security officer requires that all EBS volumes are encrypted using AWS KMS customer managed keys, and that the encryption key material is automatically rotated every year. The application must not experience any downtime, and existing volumes must remain accessible and decrypted transparently.

Which actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Turn on automatic key rotation within the configuration of the customer managed key.Answer
  2. Allow AWS KMS to keep the legacy key material versions active to decrypt data that was encrypted before the rotation.Answer
  3. C
    Manually generate a new customer managed key every year and reconfigure the EC2 instance launch templates with the new key identifier.
  4. D
    Re-encrypt all existing EBS volumes and snapshots immediately using a script once the new key material is generated.
  5. E
    Save the cryptographic key values as standard plaintext string parameters in Systems Manager Parameter Store.

Answer

Turn on automatic key rotation within the customer managed key configuration, and allow AWS KMS to keep legacy key material versions active to decrypt older data.
To satisfy the rotation requirement without modification or downtime, automatic key rotation must be enabled. AWS KMS will automatically rotate the underlying cryptographic key material annually while retaining the original key ARN. This ensures that the EBS volume configuration remains unchanged. AWS KMS also automatically preserves older versions of the key material, allowing the system to decrypt existing volumes and snapshots transparently.

Step-by-Step Solution

1
Enable automatic key rotation for the customer managed key in AWS KMS.
The backing key material will be rotated automatically every year, while keeping the same key ARN.
This avoids having to modify any EC2 launch configurations or volume attachments since the key identifier remains unchanged.
2
Ensure backward compatibility for existing EBS volumes.
AWS KMS retains the older versions of the key material to decrypt data encrypted under those versions.
This allows older backups and active volumes to continue working seamlessly without requiring immediate re-encryption.

Key Concept

AWS KMS automatic key rotation retains older key material versions for decryption while preserving the same key ARN.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic