Question

A financial services company encrypts sensitive customer records in Amazon S3 using a customer managed AWS KMS key (symmetric). To satisfy a new compliance mandate, the security team enables automatic key rotation on the KMS key. An auditor asks whether previously encrypted objects must be re-encrypted after rotation occurs, and how AWS KMS is able to decrypt objects that were encrypted before the rotation. Which statement correctly describes the behavior of automatic key rotation for this symmetric customer managed key?

Accepted Answer

AWS KMS creates new cryptographic key material but retains all older key material, so existing ciphertext remains decryptable without any re-encryption; the same key ID and ARN are used.

Answer

The company must run an S3 Batch Operations job to re-encrypt all existing objects, because the old key material is deleted the moment rotation completes.

Answer

Automatic rotation generates a new key with a new key ID and ARN, and applications must update references to the new ARN to decrypt future data.

Answer

Rotation re-encrypts all objects in place automatically within the S3 bucket as a background AWS-managed process, incurring no application changes.