CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Exam Question Walkthrough: AWS KMS for Key Management
Learn how to tackle AWS Certified Solutions Architect - Associate exam questions on encryption key management effectively.
A common stumbling block for candidates is understanding the specific services that manage encryption keys. Misinterpretation can lead to selecting an irrelevant service. In this post, we’ll dissect a typical exam question to clarify the key concepts.
The question
A company wants to centrally manage encryption keys with automatic annual rotation and detailed audit logging across many accounts. Which service should be used?
- A. AWS KMS with customer managed keys
- B. AWS Certificate Manager
- C. Amazon Macie
- D. AWS Shield
Think before you scroll
Before making a selection, consider the core requirements: central management of keys, automatic rotation, and detailed audit logging. Each of the options serves different purposes, so aligning them with the needs is crucial.
The answer
The correct option is A. AWS KMS with customer managed keys. AWS KMS provides centralized key management, automatic yearly rotation for customer managed keys, and CloudTrail audit logging of key usage. This directly addresses all the company’s needs.
Why the other options lose
- B. AWS Certificate Manager: This service manages SSL/TLS certificates but does not handle encryption keys directly. It focuses on securing communications rather than managing key lifecycle or audit logging.
- C. Amazon Macie: Macie is designed for data security and privacy, specifically to help discover and protect sensitive data in AWS. It does not provide key management capabilities, making it unsuitable for the requirements stated.
- D. AWS Shield: This is a managed DDoS protection service. It is unrelated to encryption keys, focusing on safeguarding applications from attacks rather than managing or rotating encryption keys.
The concept behind it
Centralized key management is essential for maintaining security across multiple accounts. AWS KMS allows organizations to create and manage keys, automate their rotation, and log usage for compliance and audit purposes. Understanding this principle helps in recognizing when to apply KMS versus other AWS services.
Exam trap to remember
Remember, if a question mentions centralized management, automatic rotation, and audit logging for encryption keys, AWS KMS is likely the correct answer.