DVA-C02 Question 178
Single answerYou are developing an application that uses an AWS KMS (Key Management Service) Customer Managed Key (CMK) to encrypt sensitive data. Your security team has mandated that key rotation must be set up for compliance purposes. What is the BEST approach to ensure key rotation while maintaining access to previously encrypted data?
- A
Enable AWS KMS automatic key rotation for the CMK.
- B
Manually create a new CMK and update your application to use the new key.
- C
Delete the old CMK and create a new one to replace it.
- D
Enable AWS KMS automatic key rotation and delete all previous key versions.
Show answer and explanation
Correct answer: A
Explanation
AWS KMS allows automatic key rotation for Customer Managed Keys (CMKs), ensuring that the cryptographic material is rotated annually while keeping the same key ID. This approach ensures compliance and maintains backward compatibility, allowing access to data encrypted with previous key versions. Manual processes or deleting old keys introduce unnecessary complexity and risks, so automatic key rotation is the best practice.
- A. Correct.
This is the correct answer. AWS KMS supports automatic key rotation for Customer Managed Keys (CMKs), which creates new cryptographic material for the key every year while keeping the same key ID. This ensures compliance without requiring manual intervention or affecting access to previously encrypted data.
- B. Incorrect.
Manually creating a new CMK and updating your application is not the best approach because it introduces operational overhead and creates a new key ID, which might make accessing previously encrypted data more complex.
- C. Incorrect.
Deleting the old CMK and creating a new one should never be done, as this would make all data encrypted by the old CMK inaccessible.
- D. Incorrect.
Enabling automatic key rotation is correct, but deleting previous key versions would result in losing access to any data encrypted with those versions, making this approach incorrect.