Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is designing a serverless application using AWS Lambda that needs to retrieve a database password to access an Amazon RDS DB instance. The company also uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive configuration files stored in Amazon S3. The security team requires that the database password be rotated every 30 days and the KMS key be rotated annually, while ensuring that all historically encrypted data remains accessible.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and configure automatic rotation for the secret every 30 days using an AWS Lambda function.Answer
  2. Enable automatic key rotation on the KMS customer managed key, which creates a new key version annually and retains older versions to decrypt existing data.Answer
  3. C
    Store the database password as a plain String parameter in AWS Systems Manager Parameter Store and enable automatic version rotation.
  4. D
    Enable automatic key rotation for the customer managed key, and run a scheduled script to decrypt and re-encrypt all S3 objects using the new key version immediately after rotation.
  5. E
    Store the database password in AWS Systems Manager Parameter Store as a SecureString, and delete the previous versions of the KMS key annually after rotating the key to ensure compliance.

Answer

Store the database password in AWS Secrets Manager with automatic 30-day rotation, and enable automatic key rotation on the customer managed key to rotate key material annually while retaining older versions.
The correct architecture stores the database password in AWS Secrets Manager with automated rotation via an AWS Lambda function, and enables automatic key rotation on the customer managed key. Secrets Manager secure storage prevents exposure of credentials and automates rotation. KMS automatic key rotation creates a new key version annually but preserves all previous key material, allowing transparent decryption of existing files without manual re-encryption.

Step-by-Step Solution

1
Select the secure storage and rotation mechanism for database credentials.
Determine that AWS Secrets Manager should be used for the database password, as it natively supports automatic rotation every 30 days using AWS Lambda.
AWS Secrets Manager is built for database secrets and integrates with RDS for automated rotation, whereas Systems Manager Parameter Store String parameters expose secrets in plaintext.
2
Select the rotation mechanism for the customer managed key that preserves decryptability of historical data.
Enable AWS KMS automatic key rotation for the customer managed key.
KMS automatic key rotation generates new key material annually but keeps older versions active so that existing encrypted objects can be decrypted transparently without manual re-encryption or key deletion.

Key Concept

AWS KMS key rotation mechanisms and AWS Secrets Manager credential rotation
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic