Examkin

Question

Difficulty: HardData Encryption and Key Management

A company runs a financial analytics application on Amazon ECS that queries an Amazon Aurora PostgreSQL database. The application encrypts generated PDF reports using an AWS KMS customer managed key (CMK) and stores them in an Amazon S3 bucket. The security policy mandates that the database credentials must be rotated every 15 days, and the KMS CMK used to encrypt the S3 bucket must be rotated automatically every year. The security team is concerned that rotating the CMK will make the older PDF reports in the S3 bucket unreadable.

Which configuration will meet these security requirements with the LEAST operational overhead?

  1. Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.Answer
  2. B
    Store the database credentials in AWS Systems Manager Parameter Store as a String parameter. Enable automatic key rotation on the customer managed key, and configure an AWS Lambda function to update the Parameter Store value every 15 days.
  3. C
    Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Manually rotate the customer managed key annually by creating a new key, updating the S3 bucket policy with the new key ARN, and running an S3 Batch Operations job to re-encrypt all older PDF reports.
  4. D
    Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Use a stateless Network ACL on the ECS subnet to restrict access to the KMS endpoint, and configure a custom script to rotate the database credentials and manually re-encrypt the S3 bucket objects annually.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.
The correct solution uses AWS Secrets Manager to handle the 15-day database credential rotation natively and securely. For the KMS Customer Managed Key (CMK), enabling automatic rotation is the most operationally efficient choice because it retains the same key ARN and automatically preserves older key versions. When applications request decryption of older PDF reports, AWS KMS automatically uses the corresponding older key version, eliminating the need to re-encrypt historical reports.

Step-by-Step Solution

1
Select AWS Secrets Manager to store and rotate the database credentials.
Database credentials are rotated automatically every 15 days using a built-in or custom Lambda function, ensuring security without manual script maintenance.
AWS Secrets Manager is specifically designed to store secrets and integrate with Amazon RDS and Aurora to handle automatic credential rotation natively.
2
Enable automatic key rotation on the AWS KMS customer managed key (CMK).
The CMK will have its backing key material automatically rotated once per year by AWS KMS, keeping the same key ARN.
Automatic key rotation eliminates the operational overhead of manually updating key ARNs in application code, IAM policies, and bucket policies.
3
Leave historical PDF reports in the S3 bucket as-is.
Historical PDF reports remain readable because AWS KMS preserves older key versions to decrypt data encrypted by those versions.
AWS KMS automatically manages the mapping between the encrypted ciphertext and the key version used to encrypt it, so no data re-encryption is required when automatic key rotation is enabled.

Key Concept

AWS KMS automatic key rotation retains older key versions to decrypt historical data without changing the key ARN, while AWS Secrets Manager manages DB credential rotation.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic