A solutions architect is configuring security policies for a critical financial application. The application stores its transaction logs in an Amazon S3 bucket, encrypted at rest using an AWS KMS customer managed key. The solutions architect enables automatic key rotation for the customer managed key. Which two statements correctly describe the behavior of AWS KMS and the S3 bucket after the key is rotated? (Select two.)
- New transaction logs uploaded to the Amazon S3 bucket will be encrypted using the newly generated key material.Cevap
- AWS KMS automatically retains the older key material to transparently decrypt historical transaction logs when requested.Cevap
- CAWS KMS immediately decrypts and re-encrypts all existing transaction logs in the S3 bucket using the new key material.
- DThe solutions architect must update the Amazon S3 bucket policy and application configuration with the new key Amazon Resource Name (ARN).
- EThe previous key material is deleted from AWS KMS, and historical logs must be re-encrypted manually to prevent data loss.
Cevap
The correct statements are that new logs uploaded to the Amazon S3 bucket will be encrypted using the newly generated key material, and AWS KMS automatically retains the older key material to transparently decrypt historical logs when requested.
When automatic key rotation is enabled for a customer managed key, AWS KMS creates new key material and uses it for all future encryption operations (such as encrypting new S3 uploads). To allow historical data to be read, AWS KMS retains all older versions of the key material and automatically uses them when decrypting objects that were encrypted with those older versions.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Automatic Key Rotation Mechanics