Examkin

Question

Difficulty: Very hardData Encryption and Key Management

A financial institution processes transactions in Account A using Amazon EC2 instances with encrypted Amazon EBS volumes. The volumes are encrypted using an AWS KMS customer managed key (CMK) for which the security team has enabled automatic annual key rotation. The compliance policy requires the institution to share periodic EBS snapshots with an external auditing firm operating in Account B. The auditing firm must restore these snapshots to EC2 instances in Account B. Additionally, the auditing application requires a database API key to write audit logs to a database in Account B. Which combination of actions will securely meet these requirements? (Select TWO.)

  1. In Account A, modify the key policy of the KMS customer managed key to grant Account B's IAM role permissions to perform kms:Decrypt, kms:DescribeKey, and kms:CreateGrant operations.Answer
  2. Rely on AWS KMS automatic key rotation to automatically retain older key versions, allowing Account B to decrypt and restore snapshots that were encrypted before the rotation occurred.Answer
  3. C
    Manually copy and re-encrypt all historical EBS snapshots in Account A using the new key version immediately following each annual key rotation, as rotated keys cannot decrypt existing snapshots.
  4. D
    Store the database API key in Systems Manager Parameter Store as a standard String parameter to facilitate fast, plaintext retrieval by the EC2 instances in Account B.
  5. E
    Share the default AWS managed key aws/ebs from Account A with Account B to simplify snapshot sharing, and configure Account B's EC2 service-linked role to use this key.

Answer

Modifying the KMS key policy in Account A to allow Account B to decrypt and create grants, and relying on AWS KMS automatic key rotation to automatically retain older key versions for decrypting historical snapshots.
The correct solution involves modifying the KMS key policy in Account A to permit Account B's IAM role to decrypt the snapshots and create grants for the EC2 service in Account B. It also relies on AWS KMS automatic key rotation, which automatically preserves historical key versions to decrypt snapshots that were encrypted before the rotation occurred. This ensures continuous access without administrative overhead or security compromises.

Step-by-Step Solution

1
Evaluate key sharing capability based on key type
Identify that AWS managed keys cannot be shared cross-account, which confirms a Customer Managed Key (CMK) must be used in Account A.
AWS managed keys are bound to a single account and their policies cannot be customized for cross-account delegation.
2
Determine the required KMS key policy permissions for EBS snapshot sharing
Grant Account B permissions for kms:Decrypt, kms:DescribeKey, and kms:CreateGrant in the Account A CMK key policy.
The EC2 service in Account B needs kms:Decrypt to read the snapshot data and kms:CreateGrant to delegate key usage to the EC2 service-linked role for attaching the volume.
3
Analyze the impact of KMS key rotation on historical snapshots
Determine that automatic key rotation preserves previous key versions to decrypt older snapshots, making manual re-encryption unnecessary.
AWS KMS manages key version history automatically, mapping the ciphertext to the correct historical key version during decryption.
4
Determine the secure method for database API key storage
Reject plaintext String parameter storage in favor of SecureString or Secrets Manager.
Storing credentials in plaintext is a security risk and violates compliance policies.

Key Concept

Cross-account KMS key sharing, EBS snapshot restoration permissions, KMS key rotation mechanics, and secure secret storage.
Estimated Time:3m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic