A company runs an application on AWS. The application uses an Amazon Aurora MySQL database that is encrypted with the default AWS managed AWS KMS key. The company must implement a solution to rotate…

Question

Options

• AConfigure the rotation period for the existing AWS managed KMS key to be 180 days. Implement
• BCreate a new AWS managed KMS key with automatic rotation set for 180 days. Take a snapshot
• CCreate a new customer managed KMS key with automatic rotation set for 180 days. Take a
• DCreate a new customer managed KMS key with automatic rotation set for 180 days. Update the

• A
  6% (2)
• B
  26% (8)
• C
  55% (17)
• D
  13% (4)

Explanation

AWS managed KMS keys for Aurora cannot have a custom rotation period; they rotate automatically on AWS’s schedule and cannot be enforced to 180 days. To meet the 180-day rotation requirement, a customer managed KMS key must be created with automatic rotation enabled. Restoring a snapshot to a new Aurora cluster encrypted with the new key ensures the database uses the correct key. AWS Config with a custom rule can monitor the key rotation compliance, and Amazon SNS can notify the security team if the key is noncompliant.

No community discussion yet for this question.