Customer data is stored in DynamoDB.
Audit key use and allow customer-specific operations such as disabling the key.
Which protection approach is most appropriate?
Configure a customer managed KMS key for the table and plan permissions for backup and restore.
Detailed explanation
S3 object lifecycle does not change DynamoDB encryption.
S3 object lifecycle does not change DynamoDB encryption.
At-rest encryption, key-use auditing, and lifecycle control are available.
At-rest encryption, key-use auditing, and lifecycle control are available.
CloudTrail records API events instead of encrypting table data.
CloudTrail records API events instead of encrypting table data.
IAM authorization is not encryption at rest.
IAM authorization is not encryption at rest.
Check official documentation
Compare the following points with the official documentation.
Amazon DynamoDB encryption at rest、customer managed KMS key、KMS grantsの公式説明を確認する。
What to confirm
IAM認可と保存時暗号化を別の防御層として説明できる。
Key points
- DynamoDB encryption
- Customer managed key
- KMS
- Backup
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Restore key
Verify the KMS key and permissions available during point-in-time recovery or import.
Usage audit
Correlate KMS events with DynamoDB data access.