Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company stores database backups in an Amazon S3 bucket. The backups are encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The company's security policy requires that the encryption keys be rotated annually. Which of the following actions should the solutions architect take to meet these requirements with the least operational overhead?

  1. Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.Answer
  2. B
    Enable automatic key rotation for the Customer Managed Key in AWS KMS, and schedule an AWS Batch job to immediately decrypt and re-encrypt all existing database backups in the S3 bucket under the new key version.
  3. C
    Manually create a new Customer Managed Key each year, configure the S3 bucket default encryption to use the new key, and delete the previous key immediately to prevent unauthorized access.
  4. D
    Store the encryption key material as a plaintext string parameter in AWS Systems Manager Parameter Store, and configure an AWS Lambda function to update and rotate the parameter annually.

Answer

Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.
Enabling automatic key rotation on an AWS KMS Customer Managed Key (CMK) is the most operationally efficient method to meet annual rotation requirements. When enabled, AWS KMS automatically generates new key material for the CMK every year. It keeps all older versions of the key material active so that AWS KMS can decrypt any data previously encrypted with those versions. The key ID remains unchanged, meaning application code and S3 bucket configurations do not need to be updated.

Step-by-Step Solution

1
Analyze the requirement for annual encryption key rotation with minimal operational overhead for S3 backups.
Identify that AWS KMS Customer Managed Keys support native, automated annual rotation.
Using native managed features minimizes operational overhead compared to manual key creation and rotation scripts.
2
Evaluate the behavior of AWS KMS key rotation concerning existing data decryption.
Recall that KMS preserves the older key material backing the same key ID to automatically decrypt older objects without requiring re-encryption.
This behavior eliminates the need to run data migration or re-encryption tasks on existing S3 backups.
3
Discard insecure options that store secrets in plaintext or delete key material needed for historical decryption.
Eliminate the options that advocate deleting old keys or storing secrets as plaintext parameters.
Deleting older key material causes data loss for older backups, and storing keys in plaintext violates basic AWS security best practices.

Key Concept

AWS KMS Automatic Key Rotation
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic