A KMS customer master key (CMK) was created with imported key material and is referenced by alias in a Java application for encryption. The organization needs to rotate the key material every six months. What is the proper procedure to rotate this imported-material CMK?
Choose an answer
Tap an option to check your answer.
Correct answer: Create a new CMK that contains newly imported key material, then repoint the alias to the newly created CMK..
Why this is the answer
AWS KMS does not support automatic key rotation for CMKs with imported key material. To rotate a CMK with imported key material, you must manually create a new CMK, import the new key material into it, and then update any applications or aliases to reference the new CMK. Repointing the alias to the new CMK ensures that the application automatically uses the new key material without code changes. Enabling automatic rotation is incorrect because it's not supported for imported key material. Removing and re-importing key material into the same CMK is not a valid rotation method and would likely invalidate existing encrypted data. Importing a copy into a new CMK as a backup doesn't achieve key rotation for the active key.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed