Question

A financial services company has a regulatory requirement to control and supply its own cryptographic key material for encrypting sensitive data in Amazon S3 and Amazon EBS. The security team creates a KMS key with imported key material (EXTERNAL origin) and imports a 256-bit key with a set expiration date. Several months later, an auditor asks how the team ensures this key is rotated on a regular schedule. What is the correct statement the security team should provide?

Accepted Answer

AWS KMS cannot automatically rotate keys with imported key material; rotation must be performed manually by creating a new key and re-importing new key material.

Answer

Enable automatic annual key rotation on the KMS key so AWS rotates the imported key material for them.

Answer

Configure a rotation Lambda in AWS Secrets Manager to rotate the imported key material every 90 days.

Answer

Enable automatic rotation and set a custom rotation period of 90 days on the KMS key with imported material.