DVA-C02 Question 188
Single answerA developer is working on an application that requires encryption using AWS Key Management Service (AWS KMS). The developer needs fine-grained control over the key rotation policy and IAM permissions associated with the key. Which type of AWS KMS key should the developer choose?
- A
AWS managed key
- B
Customer managed key
- C
AWS owned key
- D
Default service key
Show answer and explanation
Correct answer: B
Explanation
Customer managed keys allow developers and administrators to have full control over the key's lifecycle, including the configuration of key rotation policies and IAM permissions. This makes them the appropriate choice when fine-grained control is required. AWS managed keys, on the other hand, are pre-configured and managed by AWS, with limited customization options available to the user.
- A. Incorrect.
AWS managed keys are automatically created, managed, and rotated by AWS for use with specific AWS services. Developers cannot configure key rotation policies or IAM permissions for these keys.
- B. Correct.
Customer managed keys provide full control to the user, including the ability to define key rotation policies, control IAM permissions, and enable/disable the key as needed.
- C. Incorrect.
AWS owned keys are managed entirely by AWS and are used internally across AWS services. Customers cannot access or control these keys.
- D. Incorrect.
Default service keys are not a specific type of key in AWS KMS. This is an incorrect term in the context of AWS KMS.