AWS Certified Developer – Associate (DVA-C02)SecurityHard
A developer is designing an application that processes highly confidential customer data. The data needs to be encrypted at rest on Amazon EBS volumes attached to EC2 instances. The company requires full control over the encryption keys and wants to ensure that the keys are regularly rotated. Which encryption option should the developer choose for the EBS volumes?
- ADefault EBS encryption with AWS-managed keys.
- BEBS encryption using Customer Managed Keys (CMKs) in AWS Key Management Service (KMS).
- CEncrypt the EC2 instance's root volume during launch.
- DClient-side encryption of data before writing to the EBS volume.
Show answer & explanationAnswer & explanation
Correct answer: B. EBS encryption using Customer Managed Keys (CMKs) in AWS Key Management Service (KMS).
Using Customer Managed Keys (CMKs) in AWS KMS for EBS encryption gives the company full control over the encryption keys, including the ability to define key policies, enable and disable keys, and configure automatic key rotation. Default EBS encryption uses AWS-managed keys, which offer less control.
Why the other options are wrong
- A. Default EBS encryption uses AWS-managed keys, which do not provide the customer with full control over key management or explicit rotation schedules.
- C. Encrypting the root volume during launch is a good practice, but the question specifically asks for full control over keys and rotation, which points to KMS CMKs for EBS encryption, not just any encryption.
- D. Client-side encryption requires the application to manage encryption/decryption, adding complexity and not directly leveraging EBS encryption features.
EBS Encryption with KMS CMKs
Encrypting Amazon EBS volumes using Customer Managed Keys (CMKs) in AWS Key Management Service (KMS) provides granular control over encryption keys, including policies, audit trails, and rotation.
- Customer manages key policies and usage permissions.
- Supports automatic key rotation for CMKs.
- Provides a detailed audit trail via CloudTrail.
Memory trick: CMK gives you C-ontrol over M-y K-eys for EBS.