SAA-C03 Q683 · Security

Question

A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads. All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store. Which solution will meet these requirements?

Accepted Answer

**Option B: Create a new AWS KMS key and enable Amazon EKS KMS secrets encryption on the cluster.**

Here's why this is correct, step by step:

1. **The requirement is specific**: Secrets must be encrypted **in the Kubernetes etcd key-value store**. This is known as **envelope encryption** of Kubernetes secrets at rest.

2. **Amazon EKS natively supports this feature**: EKS provides a built-in option called **KMS Secrets Encryption** that uses a KMS Customer Managed Key (CMK) to encrypt Kubernetes secrets stored in etcd.

3. **How it works**: When enabled, Kubernetes uses the AWS KMS key as a Key Encryption Key (KEK). A Data Encryption Key (DEK) is generated and encrypted by the KEK. The DEK encrypts the actual secret data before writing to etcd. This is **envelope encryption**.

4. **Conf

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips