Examkin

Soru

Zorluk: ZorData Encryption and Key Management

A company is deploying a containerized application on Amazon ECS that requires access to an Amazon RDS for MySQL database. The security policy mandates that the database credentials must be rotated automatically every 30 days, and the database storage must be encrypted at rest using an AWS KMS customer managed key that is rotated annually. The solutions architect must implement a solution that requires the least operational effort and does not interrupt application availability or require manual re-encryption of historical data. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager, and configure automatic rotation with a schedule of 30 days using the built-in AWS Lambda rotation template.Cevap
  2. Enable automatic key rotation on the customer managed key in AWS KMS to rotate the key material annually.Cevap
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a standard String parameter, and create an Amazon EventBridge rule to run a script that updates the parameter value every 30 days.
  4. D
    Create a new KMS customer managed key every year, and configure a script to manually copy and re-encrypt all existing RDS snapshots and DB instances under the new key.
  5. E
    Enable automatic key rotation on the AWS managed key (aws/rds) for the RDS instance, and configure the rotation interval to 30 days to align with the credential rotation schedule.

Cevap

Store the database credentials in AWS Secrets Manager with automatic 30-day rotation enabled, and enable automatic key rotation on the KMS customer managed key.
The correct solution involves storing sensitive database credentials in AWS Secrets Manager and enabling automatic rotation, which natively manages 30-day cycles using a Lambda function. Additionally, enabling automatic key rotation on the KMS customer managed key allows AWS to rotate the cryptographic material annually without disrupting access to historical data or requiring re-encryption.

Adım Adım Çözüm

1
Select AWS Secrets Manager to store the database credentials securely, and configure its built-in rotation schedule to 30 days using the provided AWS Lambda rotation function.
Database credentials are automatically changed in both Secrets Manager and the RDS instance every 30 days without application downtime.
This satisfies the requirement for automatic, secure credential rotation with the least operational effort.
2
Enable automatic key rotation on the AWS KMS customer managed key used for encrypting the RDS storage.
The key material is rotated annually by AWS KMS while keeping all historical versions active.
This satisfies the annual rotation requirement without needing manual re-encryption of existing data or snapshots, ensuring high availability.

Anahtar Kavram

AWS KMS customer managed key automatic rotation mechanics and AWS Secrets Manager integration for secure, automated credential rotation.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru