Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company wants to encrypt sensitive documents stored in an Amazon S3 bucket using AWS Key Management Service (AWS KMS). The security team requires the use of a customer managed key that must be rotated automatically every year. The solutions architect must ensure that previously uploaded documents can still be decrypted after key rotation without any manual re-encryption. Which TWO actions should the solutions architect take to meet these requirements?

  1. Enable automatic key rotation on the AWS KMS customer managed key.Answer
  2. Configure the Amazon S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS) using the customer managed key.Answer
  3. C
    Re-encrypt all existing S3 objects with the new key version immediately after rotation.
  4. D
    Store the key policy administrative credentials as a plaintext parameter in Systems Manager Parameter Store.
  5. E
    Configure the key rotation task to run under the AWS account root user credentials.

Answer

Enable automatic key rotation on the customer managed key and configure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS).
Enabling automatic key rotation on the customer managed key ensures that the key material is rotated annually without manual configuration. Configuring the S3 bucket to use SSE-KMS with the customer managed key ensures all documents uploaded to the bucket are secure. When KMS key rotation occurs, AWS KMS retains the historical key material so that older files can still be decrypted seamlessly.

Step-by-Step Solution

1
Enable automatic key rotation on the customer managed key.
AWS KMS will automatically rotate the key material annually without manual action.
To satisfy the security requirement of rotating keys on a yearly schedule.
2
Configure server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.
Objects uploaded to the bucket are automatically encrypted using the specified key.
To ensure that S3 objects are encrypted at rest with the designated customer managed key.
3
Understand the retention behavior of historical key material in AWS KMS.
AWS KMS keeps older key material active to decrypt previously encrypted data.
To ensure that previously uploaded documents remain decryptable without manual re-encryption.

Key Concept

AWS KMS automatic key rotation updates the backing key material annually, while retaining older versions of the key material to allow the seamless decryption of historical data.
Estimated Time:1m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic