DVA-C02 Question 185
Single answerYou are developing an application that encrypts sensitive data using AWS Key Management Service (AWS KMS). The security team requires granular control over the key's policy, such as defining specific IAM principals who can use the key and determining whether the key can be rotated. What type of key should you use to meet these requirements?
- A
AWS managed key
- B
Customer managed key
- C
AWS owned key
- D
Default KMS key
Show answer and explanation
Correct answer: B
Explanation
Customer managed keys are the correct choice in this scenario because they allow developers and administrators to define custom key policies, specify IAM permissions, and enable or disable automatic rotation. This level of granularity is not available with AWS managed or AWS owned keys, which are controlled by AWS for specific services or internal use.
- A. Incorrect.
AWS managed keys are automatically created and managed by AWS for specific services. They do not allow the fine-grained control over key policies or rotation that the scenario requires.
- B. Correct.
Customer managed keys provide full control over key policies, including specifying IAM permissions and enabling/disabling key rotation, making them suitable for this scenario.
- C. Incorrect.
AWS owned keys are used internally by AWS and are not visible or configurable to customers. They cannot meet the requirement for granular control.
- D. Incorrect.
Default KMS key is not an official term in AWS KMS and does not correspond to any managed key type, so this option is invalid.