Question

A security engineer discovers that a customer managed KMS key used to encrypt an S3 bucket containing critical audit archives was accidentally scheduled for deletion by an administrator. The deletion is set to occur in 7 days. Several thousand objects in the bucket are encrypted with SSE-KMS using this key. The engineer must ensure no data becomes permanently inaccessible while the incident is investigated. What is the correct action to take?

Accepted Answer

Cancel the scheduled key deletion, which restores the key to the Enabled state and re-enable it if needed so the encrypted objects remain decryptable.

Answer

Immediately create a new KMS key and update the bucket's default encryption setting so future and existing objects use the new key.

Answer

Copy all objects to a new bucket encrypted with an AWS managed key before the deletion window expires, since scheduled deletions cannot be reversed.

Answer

Enable automatic key rotation on the scheduled key so AWS generates new key material that supersedes the deletion request.