Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is hosting a database application on Amazon EC2 instances. The database data is stored on attached Amazon EBS volumes, which are encrypted using an AWS Key Management Service (AWS KMS) customer managed key. Due to updated corporate compliance policies, the company must now rotate this encryption key annually. A solutions architect needs to configure the rotation while ensuring that the application suffers no downtime and that existing data remains accessible. How will enabling automatic key rotation for this customer managed key satisfy these requirements?

  1. AWS KMS generates new backing key material annually and retains the old key material to decrypt existing data, keeping the same Key ARN so that no application or resource configurations need to be updated.Answer
  2. B
    AWS KMS generates new key material and immediately triggers a background service to re-encrypt all existing blocks on the EBS volumes under the new key version to ensure compliance.
  3. C
    AWS KMS creates a completely new customer managed key with a different Key ARN, requiring the solutions architect to update the EC2 launch templates and manually re-encrypt the EBS volumes.
  4. D
    AWS KMS deletes the older backing key material during rotation to enforce security boundaries, which requires the databases to be stopped so that the volumes can be decrypted using cached data keys before the rotation finishes.

Answer

AWS KMS generates new backing key material annually and retains the old key material to decrypt existing data, keeping the same Key ARN so that no application or resource configurations need to be updated.
The correct option correctly describes AWS KMS key rotation behavior. When automatic key rotation is enabled for a customer managed key, KMS creates a new version of the backing key material every year. It retains all historical versions of the backing key material to decrypt any data previously encrypted with them. Because the Key ID and Key ARN do not change, applications and resources (like EBS volumes) continue to function without any configuration updates or downtime.

Step-by-Step Solution

1
Analyze how AWS KMS handles automatic key rotation for Customer Managed Keys.
Automatic rotation creates a new version of the backing key material annually, while keeping the Key ARN and key properties identical.
This avoids having to modify any resource policies, IAM policies, or application references pointing to the Key ARN.
2
Determine how KMS decrypts historical data after a rotation event occurs.
AWS KMS retains the older versions of the backing key material.
This allows KMS to automatically select the correct historical key version when decrypting existing data, removing the need to re-encrypt existing storage volumes or objects.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Estimated Time:1m 30s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic