During an incident drill, an operator disables a CMK that still encrypts historical archive objects an archives Lambda must decrypt. What operational impact should the team expect?
Select an answer to reveal the explanation.
Short Explanation
Disable the CMK and Decrypt hangs a “closed” sign—the archives Lambda cannot open historical objects until someone re-enables the key. Ciphertext does not carry a spare offline master key. Know that blast radius before you flip the switch in a real incident.
Full Explanation
When a CMK is disabled, cryptographic operations that require that key—including Decrypt—fail until the key is enabled again. Applications that must read historical ciphertext protected by that CMK will break immediately; this is not deferred until deletion. S3 does not silently re-encrypt under a new AWS owned key, and ciphertext does not embed usable CMK material.