Encrypt training data and logs in S3.
Limit who can use and manage the keys.
Choose two appropriate practices.
Restrict KMS-key use to required roles and define rotation, disable, deletion, and audit procedures.
Detailed explanation
Only necessary principals can decrypt.
Only necessary principals can decrypt.
The key lifecycle and incident response are controlled.
The key lifecycle and incident response are controlled.
The key itself must be protected.
The key itself must be protected.
Misuse, deletion, or disclosure impact is large.
Misuse, deletion, or disclosure impact is large.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式KMS・IAMとAIF-C01 Domain 5.1の保存データ保護を確認する。Expected result
暗号化と鍵・IAM・監査を一体で設計できる。Key points
- KMS
- Key permissions
- Rotation
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.