Examkin

Question

Difficulty: MediumData Encryption and Key Management

A financial services company processes transactions using an application hosted on AWS. The company needs to store transaction records in an Amazon S3 bucket. Compliance regulations mandate that the records must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). Additionally, the key material must be rotated annually, and the company must ensure that rotating the key does not require re-encrypting existing transaction data, while maintaining access to historical records. Which solution meets these requirements with the least operational effort?

  1. Enable automatic key rotation for the customer managed key in AWS KMS.Answer
  2. B
    Manually create a new customer managed key each year, update the S3 bucket configuration, and run an S3 Batch Operations job to re-encrypt all existing objects under the new key.
  3. C
    Store the encryption key in AWS Systems Manager Parameter Store as a standard parameter of type String, and write a custom AWS Lambda function to update the parameter value annually.
  4. D
    Use the AWS root account to create a new AWS managed key (aws/s3) each year and manually update the key policy to rotate the backing key material.

Answer

Enable automatic key rotation for the customer managed key in AWS KMS.
Enabling automatic key rotation for a customer managed key in AWS KMS automatically generates new key material annually. AWS KMS saves older key material to decrypt objects that were encrypted with those versions, avoiding the need to re-encrypt existing objects and minimizing operational effort.

Step-by-Step Solution

1
Analyze the encryption and compliance requirements.
The company needs to encrypt S3 data with a customer managed key, rotate it annually, keep access to historical data, and avoid re-encrypting existing data.
Understanding the security constraints helps eliminate options that do not support automatic rotation or require unnecessary re-encryption.
2
Evaluate the behavior of AWS KMS key rotation.
AWS KMS automatic key rotation creates new backing key material without changing the key ID. It retains older key material versions to decrypt historical data automatically without requiring object re-encryption.
This determines that enabling automatic rotation provides a zero-downtime, low-operational-overhead solution.
3
Identify and eliminate options that violate best practices or introduce operational overhead.
Discard manual key recreation and object re-encryption due to operational overhead, discard Parameter Store String parameters due to plaintext exposure, and discard root account usage due to privilege violations.
Ensures the selected answer is both compliant with security best practices and requires the least operational effort.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic