Examkin

Question

Difficulty: HardData Encryption and Key Management

An organization stores database backups in an Amazon S3 bucket. The backups are encrypted using an AWS KMS customer managed key. A new regulatory standard mandates that the encryption keys must be rotated annually. Additionally, any historical backups must be immediately re-encrypted with the new key material so that the old key material can be decommissioned and permanently deleted. Which strategy should a solutions architect recommend to meet these requirements?

  1. Create a new customer managed key, configure the backup system to use the new key, copy and re-encrypt the existing historical backups in Amazon S3 using the new key, and delete the old customer managed key.Answer
  2. B
    Enable automatic key rotation on the existing customer managed key, and delete the old key material version from the AWS KMS console.
  3. C
    Enable automatic key rotation on the existing customer managed key, which automatically re-encrypts all historical S3 backups with the new key version, allowing the old key version to be deleted.
  4. D
    Store the encryption key ARN as a plaintext String parameter in AWS Systems Manager Parameter Store, configure the backup application to fetch this parameter, and deploy an AWS Lambda function to update the parameter value with a new key ARN annually.

Answer

Create a new customer managed key, configure the backup system to use the new key, copy and re-encrypt the existing historical backups in Amazon S3 using the new key, and delete the old customer managed key.
The correct strategy is to create a new customer managed key, update the backup system configuration to point to it, copy and re-encrypt all existing historical backups in S3 using the new key, and then delete the old customer managed key. Since AWS KMS automatic key rotation keeps old key material to decrypt historical data and does not support deleting old key versions or automatically re-encrypting existing objects, manual rotation with active re-encryption is required to decommission the old key material.

Step-by-Step Solution

1
Analyze the requirements for rotating KMS keys, re-encrypting existing backups, and deleting/decommissioning the old key material.
Identified that automatic rotation keeps old key material active and does not re-encrypt historical data, whereas manual rotation (creating a new key) allows re-encryption and subsequent deletion of the old key.
Required to determine if manual or automatic rotation fits the constraint of deleting the old key material.
2
Determine the necessary steps for manual rotation.
A new customer managed key must be created, and the backup system configuration must be updated to use the new key's Amazon Resource Name (ARN).
Ensures that future backups are encrypted with the new key.
3
Address the historical backups currently encrypted with the old key.
Copy/re-encrypt existing objects in S3 to use the new key. Once all historical objects are encrypted with the new key, the old key can be safely deleted.
Fulfills the requirement that the old key material be decommissioned and permanently deleted.

Key Concept

Manual KMS Key Rotation and Re-encryption
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic