Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company is designing a secure web application that stores session logs in Amazon S3 and uses a database. The database credentials must be encrypted and rotated periodically. The session logs must be encrypted using a customer managed key in AWS KMS, and the security team requires that the KMS key be automatically rotated annually without requiring existing logs to be re-encrypted. Which of the following configurations should a solutions architect recommend to meet these security requirements? (Select TWO.)

  1. Enable automatic key rotation for the AWS KMS customer managed key, which creates a new backing key version annually while keeping the previous versions for decrypting older data.Answer
  2. Store the database credentials in AWS Secrets Manager and configure a rotation schedule using a built-in or custom AWS Lambda function.Answer
  3. C
    Store the database credentials as a Standard String parameter in AWS Systems Manager Parameter Store to allow easy rotation via parameter updates.
  4. D
    Enable automatic key rotation for the KMS key and configure an S3 Batch Operations job to re-encrypt all historical logs under the new key version immediately after rotation.
  5. E
    Manually rotate the KMS key by creating a new key each year and deleting the old KMS key to ensure only the latest key version is active.

Answer

Enable automatic key rotation for the AWS KMS customer managed key, and store the database credentials in AWS Secrets Manager with an automated rotation schedule.
Enabling automatic key rotation for the KMS key generates a new backing key annually while retaining the old backing keys. This allows the application to read old data without any code changes or manual re-encryption. AWS Secrets Manager is the standard service for storing and rotating database credentials securely using Lambda.

Step-by-Step Solution

1
Select a secure storage service for the database credentials that supports automatic rotation.
AWS Secrets Manager is selected because it natively supports rotating secrets using AWS Lambda.
Storing passwords in plain text in Parameter Store is insecure, making Secrets Manager the ideal choice for credentials.
2
Configure AWS KMS key rotation for encrypting S3 session logs.
Enable AWS KMS automatic key rotation.
Automatic key rotation creates a new backing key version annually and retains old versions, which automatically decrypts historical data without re-encryption.

Key Concept

Key rotation and secure secret management are fundamental to AWS data encryption. AWS KMS automatic rotation handles backing key versions transparently, while AWS Secrets Manager secures and rotates database credentials using Lambda.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic