You have an EBS volume attached to a running EC2 Instance that uses KMS for Encryption. Someone has deleted the Customer Key which was used for the EBS encryption. Which of the following options is needed so that the EC2 instance can still use the EBS volume?

Answer options:

A.Create a new Customer Key using KMS and attach it to the existing volume.
B.Nothing is needed as the key deletion has no immediate effect on the EC2 instance or the EBS volume.
C.Request AWS Support to recover the key.
D.Use AWS Config to recover the key.

Answer: B
Option A is incorrect because creating a new CMK and attaching it to the exiting volume will not allow the data to be decrypted. You cannot attach customer master keys after the volume is encrypted.
Option B is correct because the deletion of CMK has no immediate effect on the EC2 instance or the EBS volume because Amazon EC2 uses the plaintext data key—not the CMK—to encrypt the disk I/O to the EBS volume.
Option C is incorrect because you cannot use AWS Support to recover the key once the key has been deleted.
Option D is incorrect because once the key has been deleted, you cannot use Config to recover the key.
For more information on EBS Encryption with KMS, kindly refer to the following URLs:
https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html
https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-delete-key-material.html