A government agency must use KMS keys in AWS but retain key material generated in its on-premises HSM to meet sovereignty rules, accepting manual rotation every year with defined expiration. The architect must explain key origin trade-offs to approvers. Which statement correctly describes the control for imported versus AWS-generated key material?
Select an answer to reveal the explanation.
Short Explanation
Bringing your own key means you also take on its upkeep. You’ll remember that EXTERNAL origin means you manage expiration and reimport, while KMS can automatically rotate eligible AWS-generated key material.
Full Explanation
The correct statement reflects the sovereignty trade-off: material generated in your on-premises HSM is imported into a KMS key with EXTERNAL origin. You can set an expiration, but KMS cannot automatically rotate material it did not generate; yearly rotation therefore means generating fresh material externally and importing it into the same key. AWS-generated material is created and stored by KMS and supports automatic annual rotation. The claim that imported material rotates automatically is incorrect because EXTERNAL keys require customer-driven reimport; key policies and audit trails do not change that lifecycle behavior. The claim that AWS-generated material requires a Bring Your Own Key workflow and on-premises HSM attestation is incorrect because KMS generates that material internally, without external import. The claim that imported material uses AWS_CLOUDHSM origin is incorrect: that origin relates to custom key stores backed by CloudHSM clusters, not importing external material into a standard KMS key. Exam caveat: associate EXTERNAL with import, optional expiration, and manual rotation, and AWS_KMS with internal generation and supported automatic rotation. Practical check: verify KeyOrigin, ExpirationModel, and RotationEnabled with DescribeKey, and rehearse GetParametersForImport and reimport before expiration to avoid an outage.