A solutions architect is designing the security and encryption architecture for an Amazon Aurora PostgreSQL DB cluster that will store sensitive financial transactions. The company's compliance policy mandates that data at rest must be encrypted using an AWS Key Management Service (AWS KMS) customer managed key, and the key material must be rotated annually. The DB cluster must remain fully operational, and existing data must be readable without requiring cluster recreation, manual data re-encryption, or database downtime.
Which combination of actions should the solutions architect recommend to satisfy these requirements? (Select TWO.)
- Enable automatic key rotation for the KMS customer managed key.Answer
- Enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.Answer
- CStore the database master credentials as a String parameter in AWS Systems Manager Parameter Store to simplify rotation script access.
- DCreate a new customer managed key each year and update the Aurora DB cluster configuration to point to the new key ARN.
- EPerform an annual backup and restore of the Aurora DB cluster to a new cluster encrypted with a newly created customer managed key.
Answer
Enable automatic key rotation for the KMS customer managed key, and enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.
To encrypt the database cluster with a customer managed key, encryption must be enabled at cluster creation since encryption cannot be enabled on an existing unencrypted database. Enabling automatic key rotation in AWS KMS generates a new backing key every year while keeping the same key ARN. AWS KMS automatically uses the correct backing key version to decrypt existing data, which avoids database downtime or any need to re-encrypt old data manually.
Step-by-Step Solution
Key Concept
AWS KMS Automatic Key Rotation and DB Cluster Encryption