Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A financial services company hosts a compliance reporting application on Amazon EC2 instances. The application requires access to a static third-party API token. The security team mandates that the token must be encrypted at rest using a customer managed key that undergoes automatic annual rotation. However, to maintain data integrity, historical records encrypted with older versions of the key must remain decryptable without being re-encrypted. Which solution meets these requirements with the lowest operational overhead and cost?

  1. Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter. Encrypt the parameter using an AWS KMS customer managed key with automatic key rotation enabled.Answer
  2. B
    Store the API token in AWS Systems Manager Parameter Store as a String parameter type, and configure the default parameter encryption option using a custom KMS key that rotates annually.
  3. C
    Store the API token in AWS Secrets Manager. Configure an AWS KMS customer managed key, and write a custom AWS Lambda function to decrypt and re-encrypt all historical logs and parameters whenever the KMS key is rotated.
  4. D
    Store the API token in a configuration file on the EC2 instances. Encrypt the configuration file using AWS KMS, and embed the AWS account's root user credentials in the application code to decrypt the key.

Answer

Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter, encrypting it with a customer managed KMS key that has automatic rotation enabled.
Storing the token as a SecureString in Systems Manager Parameter Store provides secure encryption at rest without the cost overhead of AWS Secrets Manager. Utilizing a customer managed KMS key with automatic rotation enabled satisfies the annual key rotation requirement, and because KMS natively manages historical key versions to decrypt old data, no manual re-encryption of historical records is needed.

Step-by-Step Solution

1
Determine the cost-effective secrets storage service.
AWS Systems Manager Parameter Store is chosen because standard parameters are free, and the API token is static and does not require automatic rotation (which is a primary feature of the costlier AWS Secrets Manager).
Choosing the service that minimizes cost and operational overhead while meeting technical requirements.
2
Select the correct parameter type for encryption.
A SecureString parameter type is selected, referencing a customer managed AWS KMS key.
String parameters are plaintext, whereas SecureString parameters encrypt data at rest using AWS KMS.
3
Configure KMS key rotation mechanics.
Enable automatic annual rotation on the customer managed KMS key.
AWS KMS automatically retains historical key material to decrypt previously encrypted values, allowing decryption of old records without requiring manual re-encryption.

Key Concept

Secrets vs Parameter Management and KMS Key Rotation Mechanics
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic