Examkin

Soru

Zorluk: Çok zorData Encryption and Key Management

A security architect is designing a multi-account reporting pipeline. A business application running on Amazon EC2 instances in Account A must write encrypted transactional logs to an Amazon S3 bucket located in Account B. The database credentials used by the application must be rotated every 30 days, and under no circumstances should they be stored in plaintext. Furthermore, the encryption key used for S3 objects must be rotated automatically every year without requiring administrative overhead to re-encrypt existing objects or manually track key versions.

Which two actions should the solutions architect take to meet these security requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager in Account A, configure automatic rotation every 30 days using an AWS Lambda function, and grant the EC2 instance role permissions to retrieve the secret.Cevap
  2. Create a Customer Managed Key (CMK) in Account B, configure its key policy to allow the IAM role of the EC2 instances in Account A to perform kms:GenerateDataKey and kms:Decrypt operations, enable automatic key rotation, and write the logs using this CMK.Cevap
  3. C
    Store the database credentials as a String parameter in the Systems Manager Parameter Store, configure a scheduled Amazon EventBridge rule to trigger an AWS Lambda function that updates the parameter value every 30 days, and retrieve it using the EC2 instance profile.
  4. D
    Create a Customer Managed Key (CMK) in Account B, enable automatic key rotation, and configure an AWS Glue job to run annually immediately after rotation to re-encrypt all existing objects in the S3 bucket with the newly generated key material.
  5. E
    Create a Customer Managed Key (CMK) in Account B, and write a custom Lambda script that runs annually to manually create a new CMK, update the S3 bucket policy to allow access to the new key, and deprecate the old key to prevent data loss since automatic KMS rotation overwrites the active key material.

Cevap

Store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and create a Customer Managed Key in Account B with a cross-account key policy allowing the Account A EC2 role access while enabling automatic annual key rotation.
Storing database credentials in AWS Secrets Manager and enabling automatic rotation every 30 days meets the credential security requirements. To secure S3 objects across accounts, using a Customer Managed Key in Account B with a key policy allowing the application's IAM role in Account A to use the key ensures the destination account retains ownership of the encrypted objects. Enabling automatic rotation on this CMK rotates the key material annually without needing to re-encrypt old objects, as AWS KMS retains previous key material for decryption.

Adım Adım Çözüm

1
Evaluate secret storage requirements.
Database credentials cannot be stored in plaintext. AWS Secrets Manager is selected because it encrypts secrets at rest and natively supports automatic rotation every 30 days via Lambda.
This meets the security requirement for rotating database credentials without storing them as plaintext parameters.
2
Determine key location for cross-account S3 writing.
The Customer Managed Key (CMK) must be created in Account B (the destination account) so that Account B retains ownership of the encrypted objects written by Account A.
Creating the key in Account B ensures the bucket owner can manage access to the encrypted data.
3
Configure the key policy for cross-account access.
The key policy in Account B must be updated to grant the IAM role of the EC2 instances in Account A permissions to perform 'kms:GenerateDataKey' and 'kms:Decrypt' operations.
This allows the application in Account A to perform envelope encryption on S3 uploads.
4
Address key rotation requirements.
Enable automatic key rotation on the CMK in Account B. AWS KMS rotates the backing key material every year and retains historical backing keys to decrypt older logs.
This satisfies the requirement to rotate keys annually without re-encrypting older data or incurring administrative overhead.

Anahtar Kavram

AWS KMS key rotation and cross-account key policies allow for seamless annual rotation of key material without re-encrypting historical data, while AWS Secrets Manager provides secure storage and rotation of credentials.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru