Rotate a KMS key with imported material by creating a new key, importing new material, and repointing the alias

SCS-C02 By islever Editorial Last updated

Design and implement controls to protect credentials, secrets, and cryptographic key materials.

Short answer

D Create a new CMK, import new key material, and repoint the alias; auto-rotation is unavailable for imported-key keys.

Question

A company has an AWS Key Management Service (AWS KMS) customer managed key with imported key material. Company policy requires all encryption keys to be rotated every year. What should a security engineer do to meet this requirement for this customer managed key?
  1. Enable automatic key rotation annually for the existing customer managed key.
  2. Use the AWS CLI to create an AWS Lambda function to rotate the existing customer managed key annually.
  3. Import new key material to the existing customer managed key. Manually rotate the key.
  4. Create a new customer managed key. Import new key material to the new key. Point the key alias to the new key. Correct Answer

Key Takeaways

Automatic rotation is unavailable for imported-key KMS keys, and an imported-key KMS key is bound to the key material first imported (you can only reimport the same material). True rotation requires new key material, which means a new key; repointing the alias keeps application references stable while satisfying the annual-rotation policy.

A customer managed KMS key uses imported key material, and policy requires annual rotation. AWS KMS does not support automatic key rotation for keys with imported key material, and you cannot import different key material into an existing imported-key KMS key. The rotation path is to create a new customer managed key, import fresh key material into it, and point the existing key alias to the new key so callers transparently use the rotated key.

Common mistake: Enabling automatic rotation (option A)—not supported for imported key material. Or reimporting the same material to the existing key (option C)—that restores rather than rotates and does not satisfy a rotation-to-new-material policy.

Expert Analysis

Why the Answer Is Correct

KMS automatic key rotation cannot be enabled on a key with imported key material, and an imported-key KMS key cannot accept different key material once created. To rotate, you create a new customer managed key, import new key material, and update the alias to point at the new key, so applications referencing the alias transparently use rotated material and the annual policy is met.

Why the Other Options Are Wrong

A is wrong because automatic rotation is unsupported for imported key material. B is wrong because Lambda cannot rotate an imported-key KMS key's material—the material is externally sourced. C reimports the same material to the existing key, which is restoration, not rotation, and does not provide new key material as the policy requires.

Community Comment Notes

Community favored D (88 votes). A commenter cited the imported-keys doc: you cannot enable auto rotation and cannot import different material into an existing imported-key KMS key. A minority argued C, but C reuses the same material and is not a rotation.

Official Reference

https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-considerations.html

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. IPLogic 👍 1 Answered D
    The correct approach to meet the requirement of rotating the encryption key annually for a customer managed key with imported key material is: D. Create a new customer managed key. Import new key material to the new key. Point the key alias to the new key. Automatic key rotation is not supported for keys with imported key material. Therefore, you need to manually manage the rotation by creating a new key and updating the alias to point to the new key each year.
  2. 723993f 👍 1 Answered C
    c is the answer, d is unnecessary work kms cmk = metadata (id, other field) + imported material (crypto) thus kms cmk can continue to be as is with the same id, and we can import new material to it why not d - there is no mention of an alias being used, and no its not obvious, one must mention that an alias was created and being used by apps for D to be a viable solution
  3. dhewa 👍 1 Answered D
    To comply with the policy of rotating encryption keys annually, the recommended approach is to create a new customer managed key, import new key material to this new key, and then update the key alias to point to the new key. This ensures that the key rotation is handled correctly and securely.
  4. m_ch333 👍 1 Answered D
    D. - you cannot enable automatic key rotation for a KMS key with imported key material - You can reimport the same key material, but you cannot import different key material into that KMS key https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-considerations.html
  5. imymoco 👍 1
    Why not C? I think C is correct. D is viable, but it hasmore operational overhead
Show 2 more comments
  1. mikelord 👍 2 Answered D
    Option D make more sense
  2. gkaself 👍 2 Answered D
    Correct answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide