Customer data is encrypted with AWS KMS.
Rotate key material periodically while continuing to decrypt existing ciphertext.
Which method is most appropriate?
Enable automatic KMS key rotation so key material changes on a schedule while the logical key remains available for existing ciphertext.
Detailed explanation
Deleting the key can make existing ciphertext permanently undecryptable.
Deleting the key can make existing ciphertext permanently undecryptable.
KMS can rotate key material while retaining the logical key for encryption and decryption operations.
KMS can rotate key material while retaining the logical key for encryption and decryption operations.
A user name is not cryptographic key material or a KMS rotation mechanism.
A user name is not cryptographic key material or a KMS rotation mechanism.
Public key material would destroy the confidentiality boundary.
Public key material would destroy the confidentiality boundary.
Check official documentation
Compare the following points with the official documentation.
AWS KMS automatic key rotationの公式説明を確認する。
What to confirm
キー素材のローテーションとキー削除を区別できる。
Key points
- KMS automatic rotation
- Key material
- Ciphertext
Notes
- Environment: AWS公式KMSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Logical key continuity
KMS rotation can retain the key identity needed to decrypt ciphertext encrypted under earlier material.
Deletion versus rotation
Deleting a key is a destructive lifecycle action and is not a safe substitute for rotation.