Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt data in an Amazon S3 bucket. The security team enables automatic annual key rotation for this key. What will happen to the existing data that was encrypted before the key rotation occurred?

  1. A
    AWS KMS automatically decrypts and re-encrypts all historical data in the S3 bucket using the new key version within 24 hours of rotation.
  2. The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.Answer
  3. C
    The solutions architect must manually download and re-encrypt all existing data in the S3 bucket using the new key version.
  4. D
    The encryption key material is rotated, and the previous key version must be stored as a plaintext parameter in Systems Manager Parameter Store to decrypt older data.

Answer

The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.
When automatic key rotation is enabled for a customer managed key, AWS KMS retains all prior versions of the backing key. This allows AWS KMS to decrypt existing data encrypted with older key versions automatically without requiring any actions from the user or applications.

Step-by-Step Solution

1
Identify the mechanism of AWS KMS automatic key rotation for customer managed keys.
Rotation generates new backing key material for new encryption requests while keeping historical backing key material active.
This allows new data to be encrypted with the new key version while old data remains decryptable.
2
Analyze the impact of key rotation on existing data in Amazon S3.
Determine that existing S3 objects remain encrypted with the key version that was active when they were written.
AWS KMS preserves older backing keys to ensure seamless decryption of historical data.
3
Select the option that correctly describes the automatic retention and usage of historical keys.
Recognize that AWS KMS automatically resolves which backing key version is needed to decrypt the older S3 objects, requiring no manual intervention or re-encryption.
This aligns with AWS best practices for secure and operational efficiency in key management.

Key Concept

AWS KMS automatic key rotation mechanics and preservation of historical key material
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic