Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company stores database backups on Amazon EBS volumes. The volumes must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Regulatory compliance requires that the key be rotated every year, and historical data must remain accessible without requiring manual re-encryption of the volumes. Which configuration meets these requirements with the least administrative effort?

  1. Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.Answer
  2. B
    Enable automatic key rotation for the CMK. Once the rotation occurs, AWS KMS will automatically re-encrypt all existing EBS volumes and snapshots using the new key version.
  3. C
    Create a new CMK manually each year, store the key parameters and configuration details as plaintext parameters in Systems Manager Parameter Store, and run a script to update the EBS volume encryption keys.
  4. D
    Manually create a new CMK annually, associate the new CMK with the EBS volumes, and delete the old CMK to ensure that only the latest key is used for encryption and decryption.

Answer

Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.
Enabling automatic key rotation for a Customer Managed Key (CMK) in AWS KMS is the most efficient way to meet the requirements. It automatically rotates the backing key annually without needing manual configuration updates. When data is written, it is encrypted using the new backing key. When older data (historical backups) is read, AWS KMS automatically uses the corresponding older backing key that encrypted it, avoiding any need to re-encrypt the historical EBS volumes.

Step-by-Step Solution

1
Select the Customer Managed Key (CMK) in the AWS KMS console or use the AWS CLI/API.
Identify the key used for EBS volume encryption.
This is the target key that requires rotation configuration.
2
Enable automatic key rotation on the selected CMK.
AWS KMS configures the key to rotate its backing key automatically once per year.
This satisfies the annual rotation requirement with zero ongoing administrative effort.
3
Keep the previous backing keys active within AWS KMS.
Historical EBS volume backups remain decryptable.
AWS KMS automatically manages the mapping of rotated keys, allowing old data to be read transparently while new data uses the new backing key.

Key Concept

AWS KMS Customer Managed Key automatic key rotation mechanics and how it affects historical data decryption without re-encryption.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic