A company stores database backups on Amazon EBS volumes. The volumes must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Regulatory compliance requires that the key be rotated every year, and historical data must remain accessible without requiring manual re-encryption of the volumes. Which configuration meets these requirements with the least administrative effort?
- Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.Cevap
- BEnable automatic key rotation for the CMK. Once the rotation occurs, AWS KMS will automatically re-encrypt all existing EBS volumes and snapshots using the new key version.
- CCreate a new CMK manually each year, store the key parameters and configuration details as plaintext parameters in Systems Manager Parameter Store, and run a script to update the EBS volume encryption keys.
- DManually create a new CMK annually, associate the new CMK with the EBS volumes, and delete the old CMK to ensure that only the latest key is used for encryption and decryption.
Cevap
Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.
Enabling automatic key rotation for a Customer Managed Key (CMK) in AWS KMS is the most efficient way to meet the requirements. It automatically rotates the backing key annually without needing manual configuration updates. When data is written, it is encrypted using the new backing key. When older data (historical backups) is read, AWS KMS automatically uses the corresponding older backing key that encrypted it, avoiding any need to re-encrypt the historical EBS volumes.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Customer Managed Key automatic key rotation mechanics and how it affects historical data decryption without re-encryption.