Examkin

Question

Difficulty: Very hardData Encryption and Key Management

An organization stores highly confidential regulatory reports in an Amazon S3 bucket. The security policy mandates that these reports must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The policy also dictates that the encryption key must be rotated every 90 days, and any reports older than one year must be re-encrypted using the most recent key material to ensure that historical key versions can eventually be retired. Which combination of actions will meet these security requirements with the least operational overhead?

  1. A
    Enable automatic key rotation on the CMK and set the rotation period to 90 days. Rely on AWS KMS automatic key rotation to automatically re-encrypt all existing objects in the S3 bucket upon key rotation.
  2. B
    Store the report encryption key as a plain string parameter in AWS Systems Manager Parameter Store with a custom 90-day rotation policy. Create an AWS Lambda function triggered by Amazon EventBridge to retrieve the plaintext key and re-encrypt S3 objects older than one year.
  3. Enable automatic key rotation on the CMK and set the rotation period to 90 days. Run an Amazon S3 Batch Operations job with a Copy operation targeting objects older than one year, specifying the same CMK ARN as the encryption key.Answer
  4. D
    Create a script to manually generate a new KMS CMK every 90 days and update the S3 bucket default encryption settings. Configure an Amazon S3 Lifecycle rule to transition and re-encrypt reports older than one year to S3 Standard-Infrequent Access (S3 Standard-IA).

Answer

Enable automatic key rotation on the CMK and set the rotation period to 90 days, then use Amazon S3 Batch Operations with a Copy operation to re-encrypt objects older than one year under the same CMK ARN.
The correct option addresses all compliance requirements with minimal operational overhead. Since May 2024, AWS KMS Customer Managed Keys support custom automatic key rotation periods between 90 and 730 days, satisfying the 90-day rotation requirement natively. Because automatic rotation does not retroactively re-encrypt existing objects, an in-place S3 Batch Operations Copy job targeting objects older than one year is the standard best practice to force S3 to request a new data key (which will be generated from the newly rotated backing key material) and re-encrypt the data.

Step-by-Step Solution

1
Configure the AWS KMS Customer Managed Key (CMK) for automatic rotation.
Automatic rotation is enabled, and the rotation period is set to 90 days using the custom rotation period capability of CMKs.
This meets the compliance requirement of rotating the key material every 90 days with zero operational overhead for key generation.
2
Identify objects older than one year that need to be re-encrypted.
An S3 Inventory list or custom filter identifies objects that have a creation date older than 365 days.
This defines the target dataset that must be re-encrypted to phase out the older key material.
3
Execute an S3 Batch Operations Copy job on the target objects using the same CMK ARN.
The objects are copied to themselves (in-place copy). S3 requests a new data key from KMS to write the copied object, which is generated using the newly rotated active key version.
This forces the re-encryption of the historical data under the latest key version, allowing the old backing key versions to eventually be retired without modifying the S3 bucket's configuration or changing object URLs.

Key Concept

AWS KMS Customer Managed Key custom rotation periods and Amazon S3 Batch Operations for data re-encryption.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic