Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A company is building a document processing application that stores PDF files in an Amazon S3 bucket. The company's compliance policy requires all files to be encrypted at rest using a customer managed key in AWS Key Management Service (AWS KMS). The policy also mandates that the cryptographic key material must be rotated every year. After the key is rotated, the application must still be able to decrypt and access historical documents immediately without any manual intervention or decryption downtime. Which configuration should the solutions architect choose to meet these requirements?

  1. Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.Cevap
  2. B
    Enable automatic key rotation for the customer managed key, and immediately run a batch job to decrypt and re-encrypt all existing PDF files with the new key material version.
  3. C
    Manually rotate the key by creating a new customer managed key each year, configure the S3 bucket to use the new key, and delete the old customer managed key.
  4. D
    Generate custom encryption key material annually, store it as a plaintext string parameter in AWS Systems Manager Parameter Store, and configure a scheduled Lambda function to update the S3 bucket's default encryption configuration.

Cevap

Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.
Enabling automatic key rotation for a customer managed key in AWS KMS automatically creates a new version of the key material every year. AWS KMS retains the older versions of the key material indefinitely, allowing the application to decrypt historical documents transparently without any manual intervention or decryption downtime.

Adım Adım Çözüm

1
Evaluate the encryption requirements and identify the correct key type.
A customer managed key in AWS KMS is required to support the custom rotation policies and metadata management.
AWS managed keys do not support manual rotation configuration changes or cross-account access controls that might be required under strict compliance policies.
2
Determine the mechanism for key rotation.
Enable automatic key rotation on the customer managed key.
AWS KMS automatically rotates the key material every year (365 days) for customer managed keys when enabled.
3
Verify historical data access behavior after key rotation.
AWS KMS retains the older key material versions to seamlessly decrypt historical data that was encrypted under previous versions.
This avoids the need to decrypt and re-encrypt existing S3 objects, saving cost and preventing decryption downtime.

Anahtar Kavram

AWS KMS automatic key rotation rotates the backing key material while preserving older versions of the key material to decrypt historical data.
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru