Examkin

Question

Difficulty: MediumData Encryption and Key Management

An enterprise runs a mission-critical workload on Amazon EC2 instances with encrypted Amazon EBS volumes. The volumes are encrypted using an AWS KMS customer managed key. Corporate security policy dictates that the encryption keys must be rotated every year. A solutions architect needs to configure this rotation in the most operationally efficient way, while ensuring that all existing EBS snapshots can still be successfully restored at any time.

Which configuration strategy will meet these requirements?

  1. Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.Answer
  2. B
    Enable automatic key rotation for the customer managed key, which automatically schedules a background process in AWS KMS to decrypt and re-encrypt all existing EBS volumes and snapshots using the new key version.
  3. C
    Create a new customer managed key manually each year, update the Amazon EC2 launch templates to use the new key, and delete the previous key to avoid extra key storage charges.
  4. D
    Store the KMS key's administrative passwords and configuration metadata as a plain String parameter in AWS Systems Manager Parameter Store, and set up a custom AWS Lambda function to rotate them annually.

Answer

Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.
Enabling automatic key rotation for the customer managed key in AWS KMS automatically generates new backing key material every year. Because the key ID, ARN, and key policies remain unchanged, applications can continue to use the key without modifications. Historical backing key material is retained by AWS KMS, meaning existing snapshots encrypted with the old backing key material can still be decrypted and restored automatically without needing manual re-encryption.

Step-by-Step Solution

1
Analyze the encryption requirements.
The requirement states that the customer managed key must be rotated annually with minimal operational overhead, while maintaining the ability to decrypt historical snapshots.
Understanding the core constraints helps filter out solutions that introduce manual overhead or risk data loss.
2
Evaluate the behavior of AWS KMS automatic key rotation.
Automatic key rotation manages the backing cryptographic material without changing the key ID, ARN, or metadata. Old backing keys remain available for decryption.
This confirms that existing snapshots remain decryptable without any configuration changes or manual key management.
3
Identify why other configurations fail.
Re-encrypting all snapshots is unnecessary and resource-intensive, deleting old keys makes historical backups unrestorable, and plain Systems Manager parameters expose credentials.
Ensures the selected option adheres to the principles of least privilege, operational efficiency, and data integrity.

Key Concept

AWS KMS Customer Managed Key Automatic Rotation Mechanics
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic