Exam AWS Certified SysOps Administrator - Associate topic 1 question 64 discussion

If you choose to import keys to AWS KMS or asymmetric keys or use a custom key store, you can manually rotate them by creating a new KMS key and mapping an existing key alias from the old KMS key to the new KMS key. https://aws.amazon.com/kms/faqs/

why not A : Automatic key rotation is available for certain AWS-managed keys, not for imported key material.

Correct Answer: B CMKs with Imported Key Material: For AWS KMS customer master keys (CMKs) with imported key material, automatic key rotation is not supported. To meet rotation requirements, a new CMK must be created with the updated imported key material, and the alias should be updated to point to the new CMK. Other Options: Option A: Automatic key rotation is not available for CMKs with imported key material. Option C: Deleting and re-importing key material into the existing CMK does not satisfy rotation requirements, as it does not create a new CMK. Option D: Creating a backup CMK with the same key material does not address rotation requirements and does not set up regular rotation.

Rotation date AWS KMS rotates key material one year (approximately 365 days) after rotation is enabled, and then every year (approximately 365 days) thereafter. Customer managed keys Because automatic key rotation is optional on customer managed keys and can be enabled and disabled at any time, the rotation date depends on the date that rotation was most recently enabled. That date can change many times over the life of the key. For example, if you create a customer managed key on January 1, 2022, and enable automatic key rotation on March 15, 2022, AWS KMS rotates the key material on March 15, 2023, March 15, 2024, and every 365 days thereafter.

To create new cryptographic material for your customer managed keys, you can create new KMS keys, and then change your applications or aliases to use the new KMS keys. https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html