Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is building a financial application that runs on AWS Lambda and stores transaction records in an Amazon DynamoDB table. The security policy requires database credentials used by the Lambda function to be stored securely and rotated every 30 days. Additionally, the DynamoDB table must be encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) that is rotated annually without requiring manual re-encryption of historical data. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.Answer
  2. B
    Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store and use a custom Lambda function to rotate the credentials.
  3. Configure DynamoDB to use a customer managed key in AWS KMS and enable automatic key rotation for that key.Answer
  4. D
    Configure DynamoDB to use a customer managed key in AWS KMS, enable automatic key rotation, and schedule an AWS Batch script to re-encrypt historical table records.
  5. E
    Create a new customer managed key in AWS KMS each year, update the DynamoDB table configuration to use the new key, and run a script to re-encrypt all existing table items.

Answer

Storing the database credentials in AWS Secrets Manager with automatic rotation enabled, and configuring DynamoDB to use a customer managed key in AWS KMS with automatic key rotation enabled.
Storing database credentials in AWS Secrets Manager ensures secure storage and supports automatic rotation via built-in integration. Enabling automatic rotation on the KMS customer managed key ensures that AWS KMS automatically rotates the key material annually. AWS KMS retains older key material so that existing data can still be decrypted without needing to re-encrypt any data manually, which perfectly fulfills the encryption and operational constraints.

Step-by-Step Solution

1
Address credential security and rotation requirements.
Database credentials are secure and automatically rotated without downtime.
AWS Secrets Manager natively supports storing database secrets and integrates with Lambda to handle automatic 30-day rotation, satisfying the first security constraint.
2
Address database encryption and key rotation requirements.
The DynamoDB table is encrypted using a customer managed key that rotates automatically.
AWS KMS customer managed keys support automatic rotation. When automatic rotation is enabled, AWS KMS generates new key material annually and keeps older key material to decrypt historical data without requiring manual re-encryption of the data.

Key Concept

AWS KMS automatic key rotation preserves previous key material to decrypt existing data, eliminating the need for manual re-encryption. For sensitive secrets, AWS Secrets Manager provides built-in rotation capabilities, unlike SSM Parameter Store plaintext parameters.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic