Question

A SysOps administrator manages an AWS KMS customer managed key that was created by importing external key material to satisfy a regulatory requirement for on-premises key generation. During a compliance review, the auditor asks the administrator to enable automatic annual key rotation on this key. The administrator opens the key in the KMS console but finds that the automatic rotation option cannot be enabled. What is the correct explanation and remediation?

Accepted Answer

AWS KMS does not support automatic rotation for keys with imported key material; the administrator must manually rotate by importing new key material into a new key and updating references, or re-importing material into the existing key.

Answer

Automatic rotation is disabled because the key policy lacks the kms:EnableKeyRotation permission; adding it to the administrator's IAM role will allow rotation to be enabled.

Answer

Automatic rotation requires the key to be in a multi-Region configuration; the administrator must recreate the key as a multi-Region key to enable rotation.

Answer

Automatic rotation is only available for AWS managed keys, not customer managed keys; the administrator should migrate the workload to an AWS managed key.