A customer managed KMS key will protect data for years.
Refresh key material periodically while retaining access to existing ciphertext.
Which protection approach is most appropriate?
Enable automatic KMS rotation and keep references to the key ID or alias stable.
Detailed explanation
Logs are not cryptographic keys.
Logs are not cryptographic keys.
KMS rotates key material while continuing to handle ciphertext made with earlier material.
KMS rotates key material while continuing to handle ciphertext made with earlier material.
A name change does not change encryption.
A name change does not change encryption.
Existing ciphertext may become undecryptable and policy changes are risky.
Existing ciphertext may become undecryptable and policy changes are risky.
Check official documentation
Compare the following points with the official documentation.
AWS KMS automatic key rotation、key material versions、aliasesの公式説明を確認する。
What to confirm
ローテーションとキー削除・名前変更の違いを説明できる。
Key points
- Key rotation
- Key material
- Alias
- Decryption
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Ciphertext compatibility
Plan how older key material remains available for existing ciphertext.
Deletion protection
Use a waiting period and test backups and recovery before deleting a key.