Question

A financial services company must retain full control over the cryptographic material used to encrypt sensitive data in Amazon S3. To meet compliance, they create a KMS key with an origin of EXTERNAL and import their own 256-bit key material, setting it to expire after 90 days. As the expiration date approaches, the security team wants to ensure encrypted objects remain decryptable without disruption. Which action correctly extends the ability to use this key?

Accepted Answer

Reimport the exact same key material into the existing KMS key before or after expiration, optionally setting a new expiration date.

Answer

Enable automatic annual key rotation on the KMS key so AWS generates new material before expiration.

Answer

Create a new KMS key with imported material and re-encrypt all existing S3 objects before the old key expires.

Answer

Use the ImportKeyMaterial API to import a new, different 256-bit key into the same key to replace the expiring material.