AWS Certified DevOps Engineer - Professional DOP-C02

By Amazon · Question Mode

QuestionQ8

Security and Compliance

A company uses AWS Key Management Service (AWS KMS) keys with manual key rotation to satisfy regulatory compliance requirements. The security team needs notification whenever any keys have gone more than 90 days without rotation.

Which solution will achieve this?

Explanation

An AWS Config custom rule can run periodically and apply custom compliance logic to KMS keys, including determining whether the organization’s manual-rotation interval exceeds 90 days. AWS Config can send Amazon SNS notifications for resource compliance-state changes, enabling notification when a key becomes noncompliant. AWS KMS manual rotation consists of replacing a current KMS key with a new one, so this age-based requirement requires custom evaluation rather than a native KMS notification.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!