Question

A financial services company stores sensitive transaction records in an Amazon DynamoDB table. Compliance requires that the company be able to prove exactly when the encryption key was used, control key rotation on its own schedule, and be able to immediately deny all access to the data by disabling the key without deleting the table. The team currently uses the default AWS owned key for the table. Which change should the security engineer make to meet all of these requirements?

Accepted Answer

Update the table to use a customer managed KMS key so that key usage is logged in CloudTrail and the key can be rotated and disabled on demand.

Answer

Recreate the table using an AWS managed key (aws/dynamodb) and enable automatic annual key rotation.

Answer

Recreate the table using a customer managed KMS key, and rely on DynamoDB's client-side encryption library for auditing.

Answer

Keep the AWS owned key and enable AWS CloudTrail data events on the DynamoDB table to capture key usage.