Examkin

Soru

Zorluk: ZorData Encryption and Key Management

A company stores financial records in an Amazon S3 bucket. The records are encrypted using an AWS KMS Customer Managed Key (CMK). Compliance guidelines require the company to rotate the encryption key annually. Furthermore, to adhere to a security policy regarding legacy key retirement, any data encrypted with a retired key version must be re-encrypted using the new key version within 30 days of rotation, allowing the old key version to be safely disabled. Which strategy should the solutions architect recommend to satisfy these requirements?

  1. A
    Enable automatic key rotation for the existing Customer Managed Key. Once rotated, initiate a re-encryption job by specifying the newly generated backing key version ID in the KMS API calls for all historical S3 objects.
  2. B
    Store the database encryption key in AWS Systems Manager Parameter Store as a plaintext String parameter. Configure a scheduled AWS Lambda function to rotate this key parameter annually and use the plaintext parameter to re-encrypt the S3 objects.
  3. Create a new Customer Managed Key (CMK) annually, update the S3 bucket default encryption settings to use the new CMK, and use Amazon S3 Batch Operations to copy the existing objects in place to re-encrypt them with the new key. Disable the old CMK after 30 days.Cevap
  4. D
    Enable automatic key rotation for the existing Customer Managed Key. AWS KMS will automatically re-encrypt all historical S3 objects with the new backing key version, allowing the old backing key version to be safely deleted after 30 days.

Cevap

Create a new Customer Managed Key (CMK) annually, update the S3 bucket default encryption settings to use the new CMK, and use Amazon S3 Batch Operations to copy the existing objects in place to re-encrypt them with the new key. Disable the old CMK after 30 days.
The correct strategy requires manual key rotation (creating a new Customer Managed Key) because automatic KMS key rotation keeps old backing keys active to decrypt existing ciphertexts, making it impossible to disable or retire the old version. By creating a new CMK and updating S3 default encryption, new objects are secured with the new key. Running Amazon S3 Batch Operations with a copy job in-place re-encrypts historical objects under the new key, which permits safely disabling the legacy key after the 30-day period.

Adım Adım Çözüm

1
Differentiate key rotation behaviors
Automatic rotation keeps older backing keys active for decryption, which prevents deletion or disabling of old versions. Manual rotation is needed.
The scenario requires retiring and disabling the old key version within 30 days, which cannot be achieved if the old version must remain active transparently for decryption under the same key ARN.
2
Plan rotation and configure new key defaults
Create a new Customer Managed Key (CMK) annually and update the Amazon S3 bucket default encryption settings.
This ensures that all new write operations to the S3 bucket automatically use the new CMK.
3
Address historical objects
Run an Amazon S3 Batch Operations copy job on the existing objects in the bucket.
S3 Batch Operations copy jobs can copy objects in-place, triggering S3 to encrypt them with the new default KMS key, thereby performing the necessary re-encryption.
4
Retire the legacy key
Disable the old Customer Managed Key after 30 days.
Once all historical objects are re-encrypted with the new key, the old key is no longer needed for decryption and can be safely disabled to satisfy the compliance requirement.

Anahtar Kavram

Manual KMS key rotation vs. automatic rotation and bulk object re-encryption via S3 Batch Operations
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru