Use a customer managed key for S3 SSE-KMS.
Automate key-material rotation while allowing existing data to remain decryptable.
Which setting is most appropriate?
Enable automatic key rotation on the customer managed KMS key.
Detailed explanation
Deleting the key can make existing data impossible to decrypt.
Deleting the key can make existing data impossible to decrypt.
DNSSEC is not a KMS key rotation setting.
DNSSEC is not a KMS key rotation setting.
S3 lifecycle management does not manage KMS keys.
S3 lifecycle management does not manage KMS keys.
KMS rotates key material while the key ID remains usable for existing ciphertext.
KMS rotates key material while the key ID remains usable for existing ciphertext.
Check official documentation
Compare the following points with the official documentation.
AWS KMS automatic key rotationの公式説明を確認する。
What to confirm
キー削除・再作成と自動ローテーションの違いを説明できる。
Key points
- Automatic key rotation
- Customer managed key
- KMS
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Stable reference
Automatic rotation changes key material while applications can continue using the same key ID.
Key deletion risk
Deleting a key is a destructive operation that can prevent decryption of existing data.