Examkin

Question

Difficulty: HardData Encryption and Key Management

An organization stores sensitive compliance logs in an Amazon S3 bucket encrypted using an AWS KMS Customer Managed Key. Compliance policies mandate that all new logs must be encrypted with key material that is rotated annually. Additionally, any logs older than one year must be re-encrypted using a completely new Customer Managed Key to comply with a cryptographic obsolescence policy. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Enable automatic key rotation for the existing Customer Managed Key.Answer
  2. Create a new Customer Managed Key, configure the application to use it, and use Amazon S3 Batch Operations to copy and re-encrypt the historical logs older than one year under the new key.Answer
  3. C
    Enable automatic key rotation on the existing Customer Managed Key to trigger AWS KMS to automatically decrypt and re-encrypt all historical logs in the S3 bucket using the new key version.
  4. D
    Deploy an AWS Lambda function running under AWS root account credentials to programmatically decrypt and re-encrypt historical logs to prevent key policy access errors.
  5. E
    Store the KMS key configuration and the database access passwords as a plain String parameter in AWS Systems Manager Parameter Store to allow the rotation script to easily retrieve them.

Answer

The correct actions are to enable automatic key rotation for the existing Customer Managed Key and to use Amazon S3 Batch Operations to re-encrypt historical logs. Automatic key rotation manages the rotation of backing key material for new writes, while historical data re-encryption must be executed manually or via S3 Batch Operations, as AWS KMS does not retroactively re-encrypt existing S3 objects. Managing credentials via IAM roles instead of the root account and securing parameters as SecureString are fundamental AWS security best practices.
The correct actions are to enable automatic key rotation for the existing Customer Managed Key and to use Amazon S3 Batch Operations to re-encrypt historical logs. Automatic key rotation manages the rotation of backing key material for new writes, while historical data re-encryption must be executed manually or via S3 Batch Operations, as AWS KMS does not retroactively re-encrypt existing S3 objects. Managing credentials via IAM roles instead of the root account and securing parameters as SecureString are fundamental AWS security best practices.

Step-by-Step Solution

1
Enable automatic key rotation for the Customer Managed Key used for encrypting new logs.
AWS KMS will automatically rotate the backing key material every 365 days. Existing logs remain decryptable, and new logs will be encrypted using the rotated key material under the same key ARN.
This satisfies the requirement to rotate the key material used for new logs annually without breaking access to old logs.
2
Identify logs older than one year and prepare an Amazon S3 Batch Operations Copy job using a new Customer Managed Key.
The old logs are copied in-place or to a target prefix, decrypting them using the old key and re-encrypting them using the new key.
Because KMS key rotation does not retroactively re-encrypt existing objects, a new write operation (like S3 Batch Operations Copy) is required to re-encrypt historical data under a new key.

Key Concept

AWS KMS Key Rotation and Historical Data Re-encryption
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic