A company uses the Amazon Kinesis SDK to write data to Kinesis Data Streams. Compliance requirements state that the data must be encrypted at rest using a key that can be rotated. The company wants to meet this encryption requirement with minimal coding effort. How can these requirements be met?
A) Create a customer master key (CMK) in AWS KMS. Assign the CMK an alias. Use the AWS Encryption SDK, providing it with the key alias to encrypt and decrypt the data.
B) Create a customer master key (CMK) in AWS KMS. Assign the CMK an alias. Enable server-side encryption on the Kinesis data stream using the CMK alias as the KMS master key.
C) Create a customer master key (CMK) in AWS KMS. Create an AWS Lambda function to encrypt and decrypt the data. Set the KMS key ID in the function's environment variables.
D) Enable server-side encryption on the Kinesis data stream using the default KMS key for Kinesis Data Streams.

Question

Quizplus · Accepted Answer

Enabling server-side encryption on the Kinesis data stream using a customer master key (CMK) in AWS KMS with an alias allows for encryption at rest with key rotation, meeting the compliance requirements with minimal coding effort.

A Company Uses the Amazon Kinesis SDK to Write Data