A company uses an AWS Key Management Service (AWS KMS) customer managed key with imported key material. Company policy requires annual key rotation. How should a security engineer meet this requirement for this customer managed key?

For customer managed keys (CMKs) with imported key material, AWS KMS does not support automatic key rotation. Therefore, enabling automatic key rotation is not an option. Manually importing new key material into the existing CMK is also not possible; once key material is imported, it cannot be changed for that specific CMK. The correct approach is to create a new CMK, import the new key material into this new CMK, and then update any aliases to point to the new CMK. This effectively rotates the key material while maintaining the logical name (alias) for applications. Using an AWS Lambda function to rotate the key is not a direct KMS feature for imported keys and would still require the creation of a new CMK and alias update, making it an overly complex and indirect solution.