Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company stores historical financial reports in an Amazon S3 bucket. The reports are encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. To comply with regulatory standards, the company must rotate the encryption key every year. A solutions architect must implement a key rotation strategy that ensures all existing reports remain accessible for read operations while minimizing administrative overhead. Which strategy meets these requirements?

  1. Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.Answer
  2. B
    Enable automatic key rotation for the customer managed key, and run an Amazon S3 Batch Operations job to re-encrypt all existing S3 objects with the new key version immediately after rotation.
  3. C
    Create a new customer managed key manually each year, update the S3 bucket configuration, and delete the previous customer managed key to maintain security hygiene.
  4. D
    Store the current key version ID in AWS Systems Manager Parameter Store as a standard String parameter, and update the application logic to retrieve this value to encrypt new reports.

Answer

Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.
Enabling automatic key rotation for customer managed keys in AWS KMS automatically creates a new backing key version every year. Because AWS KMS retains all historical backing keys, it can seamlessly decrypt older objects when they are accessed. This requires no manual intervention, configuration changes, or re-encryption of existing data, satisfying the compliance requirement with the lowest administrative overhead.

Step-by-Step Solution

1
Identify the rotation frequency and decryption requirements for S3 objects encrypted with AWS KMS.
The requirement is annual key rotation while ensuring all older data remains readable without manual intervention.
This establishes the constraints: automatic execution and zero-downtime read access to historical objects.
2
Evaluate AWS KMS automatic key rotation capabilities.
Automatic key rotation creates a new backing key version every year but retains the metadata (ARN/ID) and the older backing keys.
By retaining the older backing keys, AWS KMS can automatically decrypt historical data encrypted with those older versions.
3
Select the option that matches KMS best practices with the lowest administrative overhead.
Enabling automatic rotation satisfies the compliance requirement without requiring any code changes, key policy updates, or data re-encryption.
This avoids manual re-encryption tasks and prevents data loss from deleting older keys.

Key Concept

AWS KMS Automatic Key Rotation
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic