DVA-C02 Question 177
Single answerYou are developing an application that uses AWS KMS to encrypt sensitive data. To ensure that your encryption keys remain secure over time, you need to implement key rotation. Which of the following approaches should you take to meet this requirement?
- A
Enable automatic key rotation for the customer-managed key in AWS KMS.
- B
Manually create a new key, update your application to use the new key, and deactivate the old key.
- C
Use the AWS-provided default keys as they automatically rotate without requiring additional configuration.
- D
Use a third-party key management system to handle key rotation instead of AWS KMS.
Show answer and explanation
Correct answer: A
Explanation
The best approach to ensure secure key rotation in AWS KMS for customer-managed keys is to enable automatic key rotation. This feature allows AWS KMS to rotate the key material annually without requiring manual intervention, keeping encryption secure and simplifying management. While AWS-managed keys also rotate automatically, they do not provide the level of control that customer-managed keys offer.
- A. Correct.
Correct. AWS KMS allows you to enable automatic key rotation for customer-managed keys. This rotates the key material every year while maintaining the same key ID.
- B. Incorrect.
Incorrect. While manually rotating keys is an option, it is not the most efficient or AWS-recommended approach when automatic key rotation can be enabled.
- C. Incorrect.
Incorrect. AWS-provided default keys (AWS-managed keys) do rotate automatically, but they are not suitable for fine-grained control as they are managed entirely by AWS and cannot be customized.
- D. Incorrect.
Incorrect. While a third-party key management system may support key rotation, this is not relevant to implementing key rotation specifically with AWS KMS in this scenario.