DVA-C02 Question 186
Single answerA developer is designing an application that requires encryption for sensitive data stored in Amazon S3. They need control over the rotation policy and permissions associated with the encryption keys. Which type of AWS KMS key should they choose?
- A
AWS managed key
- B
Customer managed key
- C
AWS owned key
- D
Service-specific key
Show answer and explanation
Correct answer: B
Explanation
Customer managed keys are the ideal choice when developers need fine-grained control over encryption keys, including defining key rotation policies and managing permissions. AWS managed keys are simpler but do not offer the same level of control. AWS owned keys are fully abstracted and inaccessible to customers.
- A. Incorrect.
AWS managed keys are managed entirely by AWS. While they are automatically rotated every three years, users cannot control the rotation policy or permissions.
- B. Correct.
Customer managed keys provide full control to the user, allowing them to define key rotation policies, grant or revoke permissions, and control lifecycle actions such as deletion.
- C. Incorrect.
AWS owned keys are used internally by AWS services and are not accessible or manageable by customers. These keys are not suitable for application-specific encryption needs.
- D. Incorrect.
Service-specific keys are not an actual category in AWS Key Management Service (KMS). This option is invalid.