A company stores audit reports in an Amazon S3 bucket. The reports are encrypted at rest using an AWS KMS customer managed key. The company's compliance policy requires that the encryption keys must be rotated annually. A solutions architect needs to configure the rotation while ensuring that all previously encrypted reports remain accessible for decryption without administrative intervention or manual key version tracking. Which two actions should the solutions architect take to meet these requirements?
- Enable automatic key rotation for the customer managed key in AWS KMS.Answer
- Retain the original customer managed key in an active state without deleting it.Answer
- CRun an Amazon S3 Batch Operations job to re-encrypt all historical reports with the new key version immediately after rotation.
- DCreate a new customer managed key each year, delete the old key, and update the S3 bucket's default encryption configuration.
- EStore the rotated KMS key material as a plaintext parameter in AWS Systems Manager Parameter Store to allow S3 access.
Answer
Enable automatic key rotation for the customer managed key and retain the original key without deleting it.
Enabling automatic key rotation allows AWS KMS to create new key material annually under the same key ARN. AWS KMS automatically retains all historical backing key material associated with the key, enabling seamless decryption of older reports without requiring any modifications to S3 or manual key management.
Step-by-Step Solution
Key Concept
AWS KMS customer managed key rotation mechanics and backing key preservation.