Examkin

Question

Difficulty: HardData Encryption and Key Management

A company stores financial records in an Amazon S3 bucket. The objects are encrypted at rest using Server-Side Encryption with AWS KMS keys (SSE-KMS) and a Customer Managed Key (CMK). To comply with new regulatory requirements, the security team mandates that the KMS key must be rotated every 90 days. Furthermore, all existing historical records in the S3 bucket must be immediately re-encrypted using the new key material as soon as the key is rotated. Which combination of actions will meet these requirements with the least operational overhead?

  1. A
    Enable automatic key rotation for the Customer Managed Key with a 90-day interval. Rely on AWS KMS to automatically and immediately re-encrypt all historical S3 objects in the background once the key rotation completes.
  2. B
    Manually generate a new Customer Managed Key every 90 days and store the new key ARN as a plaintext String parameter in Systems Manager Parameter Store. Write an AWS Lambda function to update the default bucket encryption settings and re-encrypt the historical objects using the Parameter Store value.
  3. Configure the Customer Managed Key with automatic key rotation set to a 90-day interval. Execute an Amazon S3 Batch Operations job using a copy operation to duplicate the existing objects in-place under the same key.Answer
  4. D
    Log in to the AWS account root user every 90 days. Disable the active Customer Managed Key, create a new Customer Managed Key, and use the root user credentials to run an S3 Batch Operations copy job to re-encrypt all historical objects.

Answer

Configuring the Customer Managed Key with automatic key rotation set to a 90-day interval and executing an Amazon S3 Batch Operations job to copy the objects in-place under the same key is the most operationally efficient solution.
Configuring automatic key rotation with a 90-day interval on the Customer Managed Key (CMK) allows AWS KMS to handle the rotation of key material natively. To address the requirement of re-encrypting historical objects in S3, running an S3 Batch Operations job with a copy operation to copy the objects onto themselves (in-place) forces S3 to decrypt the objects using the old key material and re-encrypt them with the newly rotated key material under the same key ID. This approach completely avoids manual key management, credential exposure, or the need to update bucket policies or application configurations.

Step-by-Step Solution

1
Enable automatic key rotation on the Customer Managed Key with a rotation period of 90 days.
AWS KMS will automatically rotate the key material every 90 days, retaining older key material for decryption.
To meet the regulatory requirement of rotating keys every 90 days natively without manual rotation script overhead.
2
Create and execute an Amazon S3 Batch Operations copy job targeting the bucket's objects, specifying the destination as the same bucket and key.
Objects are read (decrypted with the old key material) and written back (encrypted with the newly rotated key material).
To force the immediate re-encryption of all historical objects in the bucket using the new key version with minimal manual effort.

Key Concept

KMS Key Rotation Mechanics and S3 Batch Re-encryption
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic