A company's security policy requires that all Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS) used for encrypting database backups must be rotated annually. Additionally, all historical database backups must remain decryptable without administrative effort.
Which actions should a solutions architect recommend to meet these security requirements? (Select TWO.)
- Enable automatic key rotation for the Customer Managed Key in AWS KMS.Answer
- Retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.Answer
- CManually create a new Customer Managed Key each year and re-encrypt all historical database backups with the new key.
- DDisable the older versions of the Customer Managed Key after rotation to prevent unauthorized decryption of historical backups.
- EStore the decryption keys as plaintext String parameters in AWS Systems Manager Parameter Store for easy access by the backup utility.
Answer
Enable automatic key rotation for the Customer Managed Key in AWS KMS and retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.
To meet the requirements, the solutions architect should enable automatic key rotation for the Customer Managed Key in AWS KMS, which rotates the key material automatically on an annual schedule. Additionally, the older key material must be retained because AWS KMS automatically tracks and uses the correct historical key material version to decrypt older backups, eliminating the need for administrative effort or manual data re-encryption.
Step-by-Step Solution
Key Concept
AWS KMS automatic key rotation generates new key material annually for Customer Managed Keys while retaining old key material to automatically decrypt older data without requiring manual data re-encryption.