Question

A CloudOps engineer manages a customer managed KMS key (symmetric) used to encrypt sensitive data in several S3 buckets. A new compliance mandate requires that the cryptographic key material be rotated at least once per year with minimal operational effort and without re-encrypting existing objects or changing key references in applications. What should the engineer do?

Accepted Answer

Enable automatic key rotation on the existing customer managed key so AWS KMS rotates the backing key material annually while keeping the same key ID and ARN.

Answer

Create a new KMS key each year, re-encrypt all S3 objects with the new key, and update every bucket's default encryption configuration.

Answer

Switch the buckets to use an AWS managed key (aws/s3), since AWS managed keys guarantee rotation every 90 days automatically.

Answer

Import external key material into the KMS key and manually re-import new material every 12 months to satisfy the rotation requirement.