Examkin

Question

Difficulty: Very hardData Encryption and Key Management

An enterprise architecture team is reviewing the security posture of a document management system. The application stores sensitive PDF contracts in an Amazon S3 bucket. The S3 bucket currently uses Server-Side Encryption with AWS KMS (SSE-KMS) with the default AWS managed key ('aws/s3'). A new compliance mandate requires that the encryption key used for these contracts must be rotated every year. Additionally, to mitigate the risk of key exposure, all existing documents in the bucket must be immediately re-encrypted using the new key version upon rotation. Database credentials for the application must also be securely rotated every 30 days. Which combination of actions will meet these security and compliance requirements?

  1. Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.Answer
  2. B
    Enable automatic key rotation on the default AWS managed key ('aws/s3'). Rely on S3 automatic server-side encryption to automatically re-encrypt all existing objects with the new key version. Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure a scheduled AWS Lambda function to rotate the parameter value every 30 days.
  3. C
    Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. Rely on AWS KMS automatic key rotation to automatically re-encrypt all historical documents stored in the S3 bucket. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.
  4. D
    Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure AWS Systems Manager Run Command to update the parameter every 30 days.

Answer

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.
To meet the compliance requirements, a customer managed KMS key must be used because the rotation frequency of AWS managed keys (like 'aws/s3') cannot be customized. When a customer managed key is rotated, KMS creates a new backing key version for new encryption requests. However, KMS does not automatically re-encrypt existing ciphertext. To re-encrypt historical documents, an S3 Batch Operations job must perform an in-place copy, which decrypts the objects using the old backing key version and re-encrypts them using the new active backing key version. For the credentials, AWS Secrets Manager should be used as it supports automatic rotation every 30 days, unlike Parameter Store plain String parameters which lack native rotation capabilities and store sensitive data in plaintext.

Step-by-Step Solution

1
Address key rotation requirements by choosing between AWS managed keys and customer managed keys.
Identify that AWS managed keys ('aws/s3') do not support custom rotation intervals and cannot be customized. A customer managed key must be created, which supports automatic rotation every year.
Compliance requires annual key rotation, which is only configurable on customer managed KMS keys.
2
Determine the mechanism for re-encrypting historical data in the S3 bucket.
Establish that enabling automatic rotation in AWS KMS does not touch existing S3 objects. To re-encrypt existing objects under the new backing key version immediately, an S3 Batch Operations job must be run to copy the objects in-place (copying them to themselves).
AWS KMS automatic rotation only encrypts new data. Existing data remains encrypted under the older backing key versions until explicitly rewritten or copied.
3
Evaluate the secure secret storage and rotation strategy.
Select AWS Secrets Manager over Systems Manager Parameter Store plain String parameters.
AWS Secrets Manager natively supports 30-day automatic credential rotation and integrates with databases securely, whereas plain String parameters in Parameter Store store credentials in plaintext and lack native automatic rotation.

Key Concept

AWS KMS key rotation behavior, customer managed vs. AWS managed keys, and secure secret storage using AWS Secrets Manager.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic