Soru

Zorluk: OrtaData Encryption and Key Management

A solutions architect is configuring security policies for a critical financial application. The application stores its transaction logs in an Amazon S3 bucket, encrypted at rest using an AWS KMS customer managed key. The solutions architect enables automatic key rotation for the customer managed key. Which two statements correctly describe the behavior of AWS KMS and the S3 bucket after the key is rotated? (Select two.)

  1. New transaction logs uploaded to the Amazon S3 bucket will be encrypted using the newly generated key material.Cevap
  2. AWS KMS automatically retains the older key material to transparently decrypt historical transaction logs when requested.Cevap
  3. C
    AWS KMS immediately decrypts and re-encrypts all existing transaction logs in the S3 bucket using the new key material.
  4. D
    The solutions architect must update the Amazon S3 bucket policy and application configuration with the new key Amazon Resource Name (ARN).
  5. E
    The previous key material is deleted from AWS KMS, and historical logs must be re-encrypted manually to prevent data loss.

Cevap

The correct statements are that new logs uploaded to the Amazon S3 bucket will be encrypted using the newly generated key material, and AWS KMS automatically retains the older key material to transparently decrypt historical logs when requested.
When automatic key rotation is enabled for a customer managed key, AWS KMS creates new key material and uses it for all future encryption operations (such as encrypting new S3 uploads). To allow historical data to be read, AWS KMS retains all older versions of the key material and automatically uses them when decrypting objects that were encrypted with those older versions.

Adım Adım Çözüm

1
Understand the mechanism of AWS KMS automatic key rotation for customer managed keys.
Automatic key rotation creates a new version of the backing key material but leaves the Key ID and Key ARN unchanged.
This allows applications to continue using the same key identifier without configuration or policy updates.
2
Determine how existing and new data are handled after key rotation.
New encryption requests use the new key material. Existing data is not re-encrypted. Older key material is retained by AWS KMS.
KMS must keep older key material to decrypt historical data that was encrypted with previous versions of the key.

Anahtar Kavram

AWS KMS Automatic Key Rotation Mechanics
Bu soruyu puanla