The security team uses manual AWS KMS key rotation and needs notifications when any customer keys have not been rotated for more than 90 days. Which solution accomplishes this?

The correct solution is to develop an AWS Config custom rule. AWS Config continuously monitors and records your AWS resource configurations. A custom rule can be written using AWS Lambda to evaluate if KMS keys have been rotated within the specified 90-day period. If a key is found to be non-compliant (not rotated), AWS Config can then publish a notification to an Amazon SNS topic, which the security team can subscribe to. Incorrect options: AWS KMS itself does not have a built-in feature to publish notifications specifically for keys exceeding a rotation threshold. It handles automatic rotation for AWS-managed keys but doesn't alert on manual rotation compliance. AWS Trusted Advisor does not offer a check for KMS key rotation compliance. Its checks are predefined and do not include this specific scenario. AWS Security Hub aggregates security findings but doesn't inherently detect custom rotation policies for KMS keys. While Security Hub could ingest findings from AWS Config, Config is the direct detection mechanism here.