Question

A financial services company runs a real-time SageMaker endpoint that processes sensitive customer transactions. Compliance requires that the AWS KMS key used to encrypt the endpoint's storage volume be automatically rotated every year, and that all key usage be traceable for audits. The security team wants to enable rotation without changing the key ARN referenced in the endpoint configuration. Which approach satisfies these requirements with the least operational overhead?

Accepted Answer

Enable automatic key rotation on the customer managed KMS key and rely on CloudTrail to log all KMS API calls made by the endpoint.

Answer

Create a new KMS key each year, update the endpoint configuration with the new key ARN, and redeploy the endpoint.

Answer

Switch the endpoint to use an AWS managed KMS key, which handles rotation and auditing internally with no configuration needed.

Answer

Store the KMS key material in AWS Secrets Manager and configure a rotation Lambda to replace the key annually.