Question

A financial services company encrypts data at rest in Amazon S3 using a customer managed AWS KMS key. A new compliance policy requires that the cryptographic key material be rotated at least once every 12 months, and the audit team wants the process to be automatic with no application changes and no re-encryption of existing objects. What should the solutions architect do?

Accepted Answer

Enable automatic key rotation on the customer managed KMS key so AWS generates new key material annually while retaining older material to decrypt existing data.

Answer

Create a new KMS key each year, re-encrypt all existing S3 objects with the new key, and update the bucket's default encryption setting.

Answer

Switch the bucket to use an AWS managed KMS key (aws/s3), which rotates key material every 90 days automatically.

Answer

Import external key material into the KMS key and schedule a Lambda function to replace the imported material every 12 months.