SCS-C03 · Question #127
A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region. The DB cluster is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. To meet compliance…
The correct answer is B. Create a new customer managed key in us-west-1. Use this new key to encrypt the snapshot in. AWS Key Management Service (KMS) customer managed keys are regional resources. According to the AWS Certified Security - Specialty Official Study Guide and KMS documentation, a KMS key created in one AWS Region cannot be used directly in another Region. When copying an…
Question
A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region. The DB cluster is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. To meet compliance requirements, the company needs to copy a DB snapshot to the us-west-1 Region. However, when the company tries to copy the snapshot to us-west-1, the company cannot access the key that was used to encrypt the original database. What should the company do to set up the snapshot in us-west-1 with proper encryption?
Options
- AUse AWS Secrets Manager to store the customer managed key in us-west-1 as a secret. Use this
- BCreate a new customer managed key in us-west-1. Use this new key to encrypt the snapshot in
- CCreate an IAM policy that allows access to the customer managed key in us-east-1. Specify
- DCreate an IAM policy that allows access to the customer managed key in us-east-1. Specify
How the community answered
(44 responses)- A9% (4)
- B84% (37)
- C5% (2)
- D2% (1)
Explanation
AWS Key Management Service (KMS) customer managed keys are regional resources. According to the AWS Certified Security - Specialty Official Study Guide and KMS documentation, a KMS key created in one AWS Region cannot be used directly in another Region. When copying an encrypted Amazon Aurora DB snapshot across Regions, the destination Region must have access to a KMS key that exists in that Region. Because the original KMS key resides in us-east-1, it cannot be accessed or referenced in us- west-1. The correct and supported approach is to create a new customer managed KMS key in us-west-1 and specify that key when performing the cross-Region snapshot copy. Amazon RDS automatically decrypts the snapshot using the source Region key and re-encrypts it using the destination Region key during the copy process.
Topics
Community Discussion
No community discussion yet for this question.