DVA-C02 Question 180
Single answerYou are developing an application that uses an AWS KMS customer-managed key (CMK) to encrypt sensitive data. The security team has a requirement to ensure that encryption keys are rotated automatically and securely without disrupting the application. Which approach should you take to meet this requirement?
- A
Enable automatic key rotation for the KMS customer-managed key.
- B
Manually create a new KMS key and update the application to use the new key periodically.
- C
Use AWS Secrets Manager to rotate the KMS key automatically.
- D
Use the AWS CLI to schedule a key rotation job for the KMS key.
Show answer and explanation
Correct answer: A
Explanation
Key rotation is a critical part of key management to enhance security. AWS KMS provides a built-in feature to enable automatic key rotation for customer-managed keys. When enabled, the key material is rotated annually, and AWS ensures that the old key material remains available for decrypting previously encrypted data, avoiding disruptions to applications.
- A. Correct.
This is the correct approach. AWS KMS supports automatic key rotation for customer-managed keys, which rotates the key material every year without requiring manual intervention or application changes.
- B. Incorrect.
This is incorrect because manually creating and updating keys introduces operational overhead and increases the risk of misconfiguration or disruptions to the application.
- C. Incorrect.
This is incorrect because AWS Secrets Manager is used for rotating secrets like database credentials, API keys, etc., but it is not used for rotating KMS keys.
- D. Incorrect.
This is incorrect because the AWS CLI does not provide functionality to schedule automatic key rotation for KMS keys. Key rotation for KMS customer-managed keys is managed through the AWS Management Console or APIs by enabling the built-in rotation feature.