A company is designing a microservices application on Amazon EC2 instances. The application requires local EBS volumes to be encrypted at rest, and the encryption key must be rotated annually without requiring the re-encryption of existing data. Additionally, the database credentials used by the application must be stored securely, cannot be stored in plaintext, and must be rotated every 30 days. Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)
- Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption.Answer
- Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.Answer
- CStore the database credentials in AWS Systems Manager Parameter Store as a String parameter and write a custom script to rotate the value.
- DEnable automatic key rotation for the KMS key, and configure an AWS Lambda function to immediately re-encrypt all existing EBS volumes and snapshots with the new key version.
- EConfigure manual key rotation by creating a new customer managed key each year, updating the EBS volume configurations, and deleting the old key to prevent unauthorized access.
Answer
Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption, and store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.
The correct strategy combines using AWS Secrets Manager for credentials and a symmetric KMS Customer Managed Key (CMK) with automatic rotation enabled for EBS volume encryption. Secrets Manager securely stores the database credentials and manages rotation using Lambda. For EBS, KMS automatically rotates the key material annually without affecting the key ID or requiring manual re-encryption of existing data.
Step-by-Step Solution
Key Concept
AWS KMS key rotation mechanics and secure secrets management