A developer is planning to migrate on-premises company data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation. The company must use AWS Key Management Service (AWS KMS) to encrypt the data. Which type of keys should the developer use to meet these requirements?

Question

Accepted Answer

B. Symmetric customer managed keys with key material that is generated by AWS Symmetric customer managed KMS keys with AWS-generated key material are the only key type that supports AWS KMS automatic key rotation; enabling rotation causes KMS to automatically generate new cryptographic material annually while retaining old material to decrypt previously encrypted data.

Answer

A. Amazon S3 managed keys Amazon S3 managed keys (SSE-S3) are controlled entirely by AWS and do not allow the customer to manage rotation schedules or use KMS APIs, failing the requirement to use AWS KMS.

Answer

C. Asymmetric customer managed keys with key material that is generated by AWS Asymmetric customer managed KMS keys do not support automatic key rotation in AWS KMS; automatic rotation is only available for symmetric keys with AWS-generated material.

Answer

D. Symmetric customer managed keys with imported key material Customer managed KMS keys with imported key material do not support automatic rotation because AWS does not have access to re-generate the externally provided key material; rotation must be performed manually.

A developer is planning to migrate on-premises company data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation. The company must use AWS Key Manag

Question

Options

How the community answered

Why each option

Community Discussion