Question

A developer manages a customer managed KMS key used to encrypt data in an internal application. The security team requires that the cryptographic material backing the key be rotated once per year to meet a compliance mandate, with minimal operational effort and no changes to application code that references the key. What should the developer do?

Accepted Answer

Enable automatic key rotation on the existing customer managed key so KMS rotates the backing key material annually while keeping the same key ID and ARN.

Answer

Create a new customer managed key each year, update all application references to the new key ARN, and schedule deletion of the old key.

Answer

Enable automatic rotation, then re-encrypt all existing ciphertext with the new key material after each rotation to keep data readable.

Answer

Switch to an AWS managed key, since only AWS managed keys support rotation to satisfy compliance requirements.