How to Recover an EBS Volume After KMS Key Material Deletion?

Design and implement controls that provide confidentiality and integrity for data at rest. Design and implement controls to protect credentials, secrets, and cryptographic key materials.

Answer Correct answer: C — Reimport the same key material that originally was imported into the customer managed key, then attach the EBS volume.

A company uses AWS KMS. During an attempt to attach an encrypted Amazon EBS volume to an Amazon EC2 instance, the attachment fails. The company discovers that a customer managed key has become unusable because the key material for the key was deleted. The company needs the data that is on the EBS volume. A security engineer must recommend a solution to decrypt the EBS volume's encrypted data key. The solution must also attach the volume to the EC2 instance. Which solution will meet these requirements?

Import new key material into the key. Attach the EBS volume.
Restore the EBS volume from a snapshot that was taken before the deletion of the key material.
Reimport the same key material that originally was imported into the key. Attach the EBS volume. Correct Answer
Create a new key. Import new key material. Attach the EBS volume.

Community Insight

The question tests whether you know imported KMS key material is recoverable only by reimporting the exact same bytes into the same CMK; the trap is assuming new key material or a snapshot can decrypt existing ciphertext.

When imported KMS key material is deleted, the customer managed key becomes unusable and EBS volumes encrypted under it cannot be attached. This page explains why reimporting the identical key material into the same CMK is the only way to decrypt the volume's data key and restore access.

Choosing to import new key material (A) or create a new key (D) assumes any valid key material can restore access, but KMS cannot decrypt existing ciphertext with different material.

Community Discussion (1 comments)

Amantux 👍 1 Selected: C

Cuando una clave administrada por el cliente (CMK) en AWS KMS pierde su material clave importado, cualquier volumen cifrado con esa clave se vuelve inaccesible. Sin embargo, si el cliente reimporta exactamente el mismo material clave, la clave vuelve a ser funcional y los datos cifrados con ella pueden descifrarse nuevamente. Por tanto, la solución correcta es reimportar el mismo material clave que se usó originalmente para cifrar el volumen de EBS. Una vez restaurado el material, el volumen puede adjuntarse a la instancia EC2 y accederse normalmente.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A customer managed key with imported key material becomes unusable when that material is deleted, and any EBS volume whose data key is encrypted under that CMK cannot be attached or decrypted. AWS KMS allows the original key material to be reimported into the same CMK, which restores the key to a usable state with the same key ID and cryptographic material. Because the EBS volume's encrypted data key was wrapped by that exact CMK and material, reimporting the identical bytes lets KMS decrypt the data key so the volume can be attached to the EC2 instance. This is the only option that preserves the original cryptographic identity needed to read existing ciphertext.

Why the Other Options Are Wrong

Importing new key material (A) into the same CMK replaces the cryptographic material, so ciphertext encrypted under the old material cannot be decrypted. Creating a new key and importing new material (D) is even further removed: the new key has a different key ID and material and cannot unwrap the existing EBS data key. Restoring from a snapshot taken before deletion (B) does not remove the KMS dependency; the encrypted snapshot remains tied to the same unusable CMK, so restoring it still requires that key to be usable. It could also lose data written after the snapshot, so it does not meet the requirement to recover the current volume data.

Community Comment Notes

The sole community response, from Amantux, argues that an imported-material CMK becomes inaccessible after its key material is lost and that reimporting exactly the same material makes the key functional again. The comment explicitly states that reimporting "exactamente el mismo material clave" allows data encrypted under that key to be decrypted again. This aligns with AWS KMS behavior and supports choosing C over the new-material or new-key alternatives. No commenter proposed a workable snapshot-based recovery for an encrypted volume tied to the unusable key.

Official Reference

https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html

Exam Strategy

When a KMS imported-key-material question appears, ask whether existing ciphertext must be decrypted. If yes, only the original material in the original CMK can do it; new material or a new key is a decoy, and snapshots remain tied to the same unusable key.

Frequently Asked Questions

Why can't new KMS key material decrypt the existing EBS volume?

The EBS data key was wrapped by the original customer managed key and its material; different key material creates a different cryptographic key that cannot unwrap the existing ciphertext.

Does restoring a pre-deletion EBS snapshot avoid the unusable KMS key?

No. An encrypted snapshot still depends on the same CMK; without the original material it cannot be restored, and it may omit data written after the snapshot.

More SCS-C03 FAQ →

Related Analysis

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide