DVA-C02 Question 187
Single answerYou are developing an application that encrypts sensitive customer data using AWS Key Management Service (AWS KMS). Your team is debating whether to use an AWS managed key or a customer managed key. Which of the following is a key difference between these two types of keys?
- A
AWS managed keys are automatically rotated every year without user intervention, while customer managed keys require manual rotation setup.
- B
Customer managed keys allow you to define key policies and control access, while AWS managed keys do not allow for custom key policies.
- C
Customer managed keys cannot be deleted, while AWS managed keys can be deleted at any time.
- D
AWS managed keys are free to use, while customer managed keys incur additional costs.
Show answer and explanation
Correct answer: B
Explanation
The key difference between AWS managed keys and customer managed keys lies in the level of control provided to the user. Customer managed keys allow the user to define custom key policies, control access, and optionally enable rotation. AWS managed keys, on the other hand, are fully managed by AWS and do not provide customization capabilities for key policies. This makes customer managed keys more flexible but requires additional management effort.
- A. Incorrect.
Incorrect: Both AWS managed keys and customer managed keys are rotated automatically every year without manual intervention. However, customer managed keys also allow you to enable additional manual rotation if desired.
- B. Correct.
Correct: Customer managed keys allow the user to define custom key policies, providing fine-grained control over access to the key. AWS managed keys do not allow such customization, as AWS fully manages their policies.
- C. Incorrect.
Incorrect: Customer managed keys can be scheduled for deletion (with a configurable waiting period), just like AWS managed keys. This statement is not true.
- D. Incorrect.
Incorrect: Both AWS managed keys and customer managed keys incur charges for encryption and decryption operations. There is no cost difference based solely on the type of key.