Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is migrating a high-performance transactional database to an Amazon Aurora MySQL DB cluster. The database contains personally identifiable information (PII) that must be encrypted at rest. The company's security policy requires that the KMS key used for database encryption must be rotated annually. Additionally, the database connection credentials must be rotated every 30 days. These requirements must be met with minimal manual intervention and no database downtime. Which combination of actions will meet these requirements? (Select TWO.)

  1. Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest.Answer
  2. Store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a String parameter, and write a custom AWS Lambda function to rotate the credentials every 30 days.
  4. D
    Configure the Aurora database cluster to use the AWS managed key (aws/rds) for encryption, and schedule a manual key rotation event in AWS KMS every 30 days.
  5. E
    Enable automatic key rotation for the customer managed key, and schedule a monthly maintenance window to decrypt and re-encrypt the Aurora database storage volumes under the new key version.

Answer

Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest. Additionally, store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.
To satisfy the annual rotation requirement without database downtime, a customer managed key (CMK) must be created in AWS KMS with automatic key rotation enabled. AWS KMS automatically rotates CMKs every year and retains older key versions to seamlessly decrypt historical data. To rotate the database credentials every 30 days without manual effort, AWS Secrets Manager should be used, as it integrates directly with Amazon Aurora to handle credential rotation.

Step-by-Step Solution

1
Address database encryption at rest and the annual key rotation requirement.
Create a customer managed key (CMK) in AWS KMS and enable automatic key rotation. Since CMKs rotate annually by default and retain older backing keys, the database remains readable without manual intervention or downtime.
AWS managed keys rotate every three years, which does not satisfy the company's annual rotation policy. Customer managed keys support annual automatic rotation.
2
Address secure storage and automatic rotation of database credentials.
Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.
AWS Secrets Manager has built-in integration to rotate RDS/Aurora credentials automatically using a Lambda function, avoiding plaintext parameter storage risks.

Key Concept

AWS KMS customer managed keys support annual automatic key rotation while preserving historical backing keys to decrypt existing data. AWS Secrets Manager provides native, secure, and automated credential rotation for Amazon RDS/Aurora databases.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic