Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is designing a secure architecture for a web application. The application requires access to a database password for an Amazon RDS for PostgreSQL DB instance. The security policy requires database credentials to be rotated every 30 days. In addition, the application stores transactional logs in an Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) that is automatically rotated every year. The solutions architect must ensure that previously encrypted logs can still be decrypted after key rotation.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager, and configure automatic rotation every 30 days using the database-specific AWS Lambda rotation function.Answer
  2. Enable automatic key rotation for the KMS CMK. AWS KMS automatically retains the older backing keys to decrypt logs that were encrypted prior to rotation.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a plaintext String parameter to simplify rotation scripts.
  4. D
    Manually create a new KMS CMK each year, delete the old CMK, and re-encrypt all existing log files in the S3 bucket using the new CMK.
  5. E
    Enable automatic key rotation for the KMS CMK, and configure a scheduled task to re-encrypt all historical log files under the new key version immediately after rotation.

Answer

Store the database credentials in AWS Secrets Manager with automatic Lambda rotation, and enable automatic key rotation for the KMS CMK.
The correct combination of actions involves using AWS Secrets Manager to store and automatically rotate database credentials every 30 days, and enabling automatic key rotation for the KMS CMK. AWS Secrets Manager provides native database credential rotation using Lambda, which simplifies configuration. AWS KMS automatic key rotation keeps old key material active for decryption, ensuring historical logs remain readable without any manual re-encryption or key management.

Step-by-Step Solution

1
Address the requirement to securely store and automatically rotate database credentials every 30 days.
Database credentials should be stored in AWS Secrets Manager, which natively integrates with RDS databases to automate credential rotation using built-in AWS Lambda rotation templates.
Secrets Manager allows for secure storage and provides out-of-the-box support for rotating RDS database credentials without manual scripting.
2
Address the requirement to encrypt S3 logs using a KMS CMK with annual rotation, ensuring historical logs remain decryptable.
Enable automatic annual key rotation on the Customer Managed Key (CMK) in AWS KMS.
AWS KMS automatic key rotation generates a new backing key every year but retains the historical backing keys. This allows KMS to automatically decrypt historical data encrypted under previous versions of the key without requiring re-encryption of existing logs.

Key Concept

AWS KMS Customer Managed Key automatic rotation retains older key versions for decryption, and AWS Secrets Manager provides built-in rotation integration for Amazon RDS.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic