Your company use AWS KMS for management of its customer keys. From time to time, there is a requirement to delete existing keys as part of housekeeping activities.

Your company use AWS KMS for management of its customer keys. From time to time, there is a requirement to delete existing keys as part of housekeeping activities.

What can be done during the deletion process to verify that the key is no longer being used.
A . Use CloudTrail to see if any KMS API request has been issued against existing keys
B . Use Key policies to see the access level for the keys
C . Rotate the keys once before deletion to see if other services are using the keys
D . Change the IAM policy for the keys to see if other services are using the keys

View Answer

Answer: A

Explanation:

The AWS lentation mentions the following

You can use a combination of AWS CloudTrail, Amazon CloudWatch Logs, and Amazon

Simple Notification Service (Amazon SNS) to create an alarm that notifies you of AWS

KMS API requests that attempt to use a customer master key (CMK) that is pending

deletion. If you receive a notification from such an alarm, you might want to cancel deletion

of the CMK to give yourself more time to determine whether you want to delete it

Options B and D are incorrect because Key policies nor IAM policies can be used to check

if the keys are being used.

Option C is incorrect since rotation will not help you check if the keys are being used. For more information on deleting keys, please refer to below URL: https://docs.aws.amazon.com/kms/latest/developereuide/deletine-keys-creatine-cloudwatch-alarm.html

The correct answer is: Use CloudTrail to see if any KMS API request has been issued against existing keys Submit your Feedback/Queries to our Experts