A network engineer is using AWS Direct Connect connections and MACsec to encrypt data from a corporate data center to the Direct Connect location…

When a MACsec secret key is compromised, the only secure course of action is to replace it entirely. This involves generating a new pre-shared key, which consists of a new Connection Key Name (CKN) and a new Connectivity Association Key (CAK). This new key must then be associated with the AWS Direct Connect connection, which replaces the compromised key. While the secret can be stored in AWS Secrets Manager and encrypted with either an AWS managed or customer managed key from AWS KMS, using an AWS managed key is the default, simpler configuration, making it the most suitable choice when no other compliance requirements are specified.

B. Using a customer managed key is a valid but more complex option. The AWS managed key is the default and simpler choice, making it the better general answer.

C. Re-associating the existing, compromised key is insecure and fails to address the security breach. A new, uncompromised key must be generated.

D. The process involves creating and associating a new key, which replaces the old one. The term "modify" is inaccurate for this replacement operation.

1. AWS Direct Connect User Guide, "Work with MACsec keys": Under the "Associate a MACsec key" section, the documentation states, "You can associate a new MACsec key with a connection at any time. When you do, the new key replaces the existing key." This confirms that creating and associating a new key is the correct procedure to replace an existing one.

2. AWS Direct Connect API Reference, AssociateMacSecKey: The documentation for this API action shows that the required parameters include connectionId, ckn, and cak. This demonstrates that a new CKN/CAK pair is provided to AWS to establish the new key association, effectively replacing any prior key.

3. AWS Secrets Manager User Guide, "Encryption at rest": This guide explains how secrets are protected. It states, "By default, Secrets Manager encrypts the secret value with the AWS managed key aws/secretsmanager." This supports the choice of an AWS managed key (Option A) as the standard, default mechanism for protecting the secret key material.