Question

A CloudOps engineer receives an alert that a customer managed AWS KMS key used to encrypt several production RDS databases and EBS volumes has been scheduled for deletion by a departing team member. The deletion is scheduled to occur in 6 days. The engineer must ensure the encrypted data remains accessible and prevent accidental data loss. What is the MOST appropriate immediate action?

Accepted Answer

Cancel the scheduled key deletion, which returns the key to the Disabled state, then re-enable the key.

Answer

Create a new KMS key and re-encrypt all RDS databases and EBS volumes before the deletion window closes.

Answer

Wait for the deletion to complete, then restore the key from an automatic KMS backup in the same Region.

Answer

Export the key material to an S3 bucket, delete the key, and re-import the material into a new key afterward.