A SysOps administrator has an AWS CloudFormation template that is used to deploy an encrypted Amazon Machine Image (AMI). The CloudFormation template will be used in a second account so the SysOps…

Question

Options

• AChange the AMI permissions to mark the AMI as public.
• BDeregister the AMI in the source account.
• CRe-encrypt the destination AMI with an AWS Key Management Service (AWS KMS) key from the
• DUpdate the CloudFormation template with the ID of the AMI in the destination account.

• A
  6% (2)
• B
  8% (3)
• C
  83% (30)
• D
  3% (1)

Explanation

While launching the instance from a shared encrypted AMI, you can specify a KMS key of your choice. You may also choose cmkSource to encrypt volumes in your account. However, we recommend that you re-encrypt the volumes using a KMS key in the target account. This protects you if the source KMS key is compromised, or if the source account revokes permissions, which could cause you to lose access to any encrypted volumes you created using cmkSource. https://aws.amazon.com/blogs/security/how-to-share-encrypted-amis-across-accounts-to-launch- encrypted-ec2-instances/

No community discussion yet for this question.