A company’s application currently encrypts files by using an AWS Key Management Service (AWS KMS) AWS owned key. The security team wants the flexibility to switch to new key material for all future files whenever a potential key compromise is suspected. A security engineer must implement a solution that allows on-demand key changes. Which solution meets these requirements?

The correct solution uses a KMS key alias because aliases provide a flexible way to manage which KMS key is used for encryption without modifying application code. When a key compromise is suspected, a new customer managed KMS key (CMK) can be created, and the alias can be updated to point to this new key. All subsequent encryption operations using that alias will then use the new key material. AWS owned keys and AWS managed keys do not offer the same level of control over key material or on-demand rotation as CMKs. While CMKs support automatic annual key rotation, this scenario requires on-demand rotation, which is best achieved by creating a new CMK and updating an alias.