Question
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 123456789012. The attack created workloads that are distributed across multiple AWS Regions.
The security engineer contains the attack. The security engineer removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.
The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws:kms:us-east-2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible.
Which solution will meet this requirement?
- A. Log in to the account by using the account root user credentials. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
- B. Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days. Correct
- C. Update the IAM principal to allow kms:* permissions on the KMS key ARN. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
- D. Disable the KMS key. Re-issue the deletion request for the KMS key in 30 days.
Explanation
The key ID starts with mrk-, so this is a multi-Region primary key. AWS KMS does not delete a primary key while it still has replica keys: you must schedule deletion of every replica key, and the waiting period for the primary key begins only when the last replica has been deleted. That is why the earlier deletion request has not taken effect. Finding the Regions that hold replicas with the same key ID and scheduling them for deletion with the minimum 7-day waiting period is the fastest path. Using the root user or adding kms:* permissions does not help, because permissions were never the problem and re-issuing the request on the primary still waits for the replicas. Disabling the key and waiting 30 days is slower and still leaves the replicas blocking deletion.
