Examkin

Question

Difficulty: HardData Encryption and Key Management

A company is developing a serverless application that processes highly sensitive client records stored in an Amazon S3 bucket. The records must be encrypted at rest using an AWS KMS customer managed key. The company's compliance policy requires that the encryption key be rotated every 90 days. Additionally, legacy records encrypted with older versions of the key must remain accessible for read operations without manual administrative intervention. The security team also requires that access to the KMS key be restricted using the principle of least privilege, ensuring that even the AWS account root user cannot access the key unless explicitly permitted.

Which two actions should a solutions architect take to meet these requirements?

  1. Enable automatic key rotation on the customer managed key and configure the rotation period to 90 days.Answer
  2. B
    Create a new customer managed key every 90 days, update the S3 bucket configuration to use the new key, and run an S3 Batch Operations job to re-encrypt all historical records.
  3. Modify the KMS key policy to remove the default policy statement that grants the AWS account root user access to the key, and explicitly list the authorized IAM roles.Answer
  4. D
    Enable automatic key rotation on the customer managed key, and configure a Lambda function to decrypt and re-encrypt all existing S3 objects under the new key version immediately after rotation.
  5. E
    Store the KMS key credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to allow administrative access while bypassing the key policy.

Answer

Enable automatic key rotation on the customer managed key with a 90-day rotation period, and modify the KMS key policy to remove the default statement that delegates access to the account root user while explicitly defining authorized IAM roles.
Enabling automatic key rotation with a 90-day period meets the compliance timeline while keeping older key material available for automatic decryption. Removing the default root statement from the KMS key policy ensures that access is governed strictly by the key policy itself and cannot be bypassed via IAM policies.

Step-by-Step Solution

1
Configure the rotation parameters of the AWS KMS customer managed key.
Enable automatic key rotation and customize the rotation period to 90 days.
This satisfies the 90-day rotation compliance rule. AWS KMS keeps all historical key versions, so S3 can automatically decrypt older objects without administrative effort.
2
Analyze the default KMS key policy structure.
Identify the default statement that grants root account permissions (arn:aws:iam::account-id:root).
By default, KMS keys delegate access control to the account's IAM policies through this root statement.
3
Modify the key policy to implement least privilege.
Remove the default root user permission statement and define explicit IAM roles that are allowed to perform decryption and encryption operations.
Removing the default statement ensures that IAM policies alone cannot grant access to the KMS key, thereby preventing the root user or unauthorized administrators from using the key unless explicitly permitted by the key policy.

Key Concept

AWS KMS Key Policies and Automatic Rotation Mechanics
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic