Your security policy requires yearly rotation of KMS keys encrypting S3 data. Which option rotates backing key material with the least operational effort?
A.Manually create a new key each year and update all references
Works but is heavy: every grant, alias, and app reference must be updated and data re-encrypted.
B.Enable automatic key rotation on the customer-managed KMS key
Correct. One toggle gives annual rotation with a stable key ID.
C.Use SSE-S3 and rotate keys with a bucket policy
SSE-S3 doesn't use KMS keys or bucket-policy rotation — this option is incoherent.
D.Re-encrypt all objects with a new customer master key annually
Re-encrypting everything annually is the manual, error-prone path rotation exists to avoid.
Why this answer
Automatic rotation on a customer-managed KMS key rotates the backing material yearly while keeping the same key ARN — no reference updates or re-encryption needed. SSE-S3 keys rotate automatically anyway (no KMS needed).
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Encryption & Key Management practice session.
Practice Encryption & Key Management