Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 178 discussion

The answer is B Store the credentials in AWS Key Management Service, it is used for creating and managing encryption keys

Looking native, software-based AWS service. So it has to be AWS KMS.

B. Use AWS Key Management Service (AWS KMS) with customer master keys (CMKs) to store master key material and apply a routine to re-create a new key periodically and replace it in AWS KMS. AWS Key Management Service (AWS KMS) is a native, software-based service that allows you to create and control the encryption keys used to encrypt your data. You can use customer master keys (CMKs) in AWS KMS for encryption of Amazon S3 buckets and Amazon EBS volumes. By periodically rotating the keys, you enhance security. AWS KMS provides a convenient way to manage key lifecycle, including key rotation, without the need for manual intervention. It integrates well with other AWS services, making it a suitable choice for scenarios like the one described.

CHATGPT RESONATES WITH B By using AWS KMS with customer master keys (CMKs), the company can ensure that all Amazon S3 buckets and Amazon Elastic Block Store (Amazon EBS) volumes are encrypted with keys created and periodically rotated by internal security specialists. The CMKs can be set to expire after a certain period, at which point a new CMK can be created and applied. Option A is not the best solution as AWS Secrets Manager is designed to securely store secrets such as database credentials, API keys, and other sensitive information, but not for storing encryption keys. Option C is not ideal for this scenario as AWS CloudHSM is a hardware security module that provides secure key storage and cryptographic operations. While it is highly secure, it is also more complex to set up and manage. Option D is also not the best solution as AWS Systems Manager Parameter Store is designed for storing and managing configuration data, but not for storing encryption keys.

B is the right answer with KMS and CMS , key can rotated and managed by customer

A is right . Secret Manager can use rotating original keys like A, B,C,D..., KMS use rotating encryption keys based on original material. For instance , make A1,A2,A3,A4.. based on A by envelop encryption.This topic is about rotating like A,B,C,D... these keys is provided by specialists . So just use secret manager

A is right

https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html B

B should be right With Amazon S3 default encryption, you can set the default encryption behavior for an S3 bucket so that all new objects are encrypted when they are stored in the bucket. The objects are encrypted using server-side encryption with either Amazon S3-managed keys (SSE-S3) or AWS KMS keys stored in AWS Key Management Service (AWS KMS) (SSE-KMS). https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html Amazon EBS offers a straight-forward encryption solution of data at rest , data in transit, and all volume backups. Amazon EBS encryption is supported by all volume types, and includes built-in key management infrastructure without having you to build, maintain, and secure your own keys. We use AWS Key Management Service (AWS KMS) envelope encryption with customer master keys (CMK) for your encrypted volumes and snapshots. https://aws.amazon.com/blogs/compute/must-know-best-practices-for-amazon-ebs-encryption/

A, CMS keys will be managed from costumer

Store the credentials in AWS Key Management Service, it is used for creating and managing encryption keys

Ans: A Secrets Manager integrates with AWS Key Management Service (AWS KMS) to encrypt every version of every secret value with a unique data key that is protected by an AWS KMS key. This integration protects your secrets under encryption keys that never leave AWS KMS unencrypted. It also enables you to set custom permissions on the KMS key and audit the operations that generate, encrypt, and decrypt the data keys that protect your secrets.

Seems to be A, see https://docs.aws.amazon.com/kms/latest/developerguide/services-secrets-manager.html

A. Use AWS Secrets Manager with customer master keys (CMKs) to store master key material and apply a routine to create a new CMK periodically and replace it in AWS Secrets Manager.

Passed the exam on 26th June, this question was on my test.

I agree with B. (https://aws.amazon.com/kms/features/#Secure) Encryption keys are stored in KMS, not Secrets Manager. Secrets Manager stores database credentials, API keys & OAuth tokens.

as per https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html A can also fit