Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is migrating a legacy payment processing application to Amazon EC2. The database for the application stores sensitive cardholder data on Amazon EBS volumes. The company's security policy requires that all EBS volumes be encrypted at rest using a customer managed key in AWS KMS. Additionally, the policy mandates that the encryption keys be rotated annually, and that all existing volumes and snapshots remain decryptable without manual intervention or data re-encryption. Which two steps should a solutions architect take to meet these requirements? (Select TWO.)

  1. Enable automatic key rotation for the customer managed key in AWS KMS.Answer
  2. Configure Amazon EBS encryption to use the customer managed key when creating the volumes.Answer
  3. C
    Create a new customer managed key annually and update the EC2 launch templates to reference the new key ARN.
  4. D
    Create a script to copy all existing EBS snapshots and re-encrypt them under the new key version after rotation.
  5. E
    Store the KMS key material as a plain String parameter in Systems Manager Parameter Store for the application to mount the volumes.

Answer

Configure Amazon EBS encryption to use the customer managed key when creating the volumes, and enable automatic key rotation for the customer managed key in AWS KMS.
To encrypt the EBS volumes securely with a customer managed key, Amazon EBS encryption must be configured to use the specified customer managed key. Enabling automatic key rotation in AWS KMS ensures that the key material is rotated annually without changing the key ARN or requiring any configuration updates. AWS KMS automatically retains the older key material so that existing volumes and snapshots can be decrypted transparently.

Step-by-Step Solution

1
Identify the encryption requirement for the EBS volumes.
Determine that the volumes must be encrypted with a Customer Managed Key (CMK) in AWS KMS.
This satisfies the requirement to encrypt volumes using a customer managed key rather than the default AWS managed key.
2
Address the annual rotation requirement without manual intervention or re-encryption.
Enable automatic key rotation on the customer managed key in AWS KMS.
AWS KMS automatic key rotation generates new key material annually while retaining the old key material. This allows existing snapshots and volumes to be decrypted seamlessly without any manual re-encryption.

Key Concept

AWS KMS Customer Managed Key automatic rotation and EBS encryption integration.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic