After a contractor is offboarded, the city must re-encrypt a subset of grant files under a new data-key hierarchy so the contractor's former access path cannot decrypt them. What should the application team plan?
Select an answer to reveal the explanation.
Short Explanation
When trust changes, you do not just take back the badge — you change the locks on the files that person could open. Plan a re-encryption pass with new data keys and point the app at the rotated hierarchy.
Full Explanation
Key or trust changes often require re-encrypting data under new data keys or a new CMK hierarchy and updating application retrieve/decrypt paths. Removing only a console password leaves ciphertext decryptable with retained key material. Disabling CloudTrail reduces auditability. Storing old keys in plaintext environment variables increases risk rather than completing rotation.