A pharmaceutical firm must generate AES-256 keys in its on-premises HSM for regulatory custody, use them in KMS for S3 encryption, rotate the material every year, and retain AWS audit trails of expiration. Which imported key material and rotation design satisfies the custody and rotation mandate?
Select an answer to reveal the explanation.
Short Explanation
You're handling strict custody rules where provenance matters most. Annual reimport keeps you in control of the origin while KMS still enforces expiration and audit trail.
Full Explanation
A KMS key created with Origin EXTERNAL holds only a reference until the customer imports key material generated outside AWS, and rotation is a customer responsibility performed by generating new material externally, importing it with ImportKeyMaterial, and running on-demand rotation (RotateKeyOnDemand) under the same key ID, optionally setting an expiration time that triggers CloudTrail and key state changes for auditability with S3 envelope encryption continuing to work because the key ID is stable. Using AWS generated material with automatic rotation fails by concept because KMS then creates and retains backing material internally, violating the requirement that material originate in the on-premises HSM and remain under customer custody. Using an external key store with AWS generated material fails by concept because XKS keeps keys in the external key manager and proxies cryptographic operations, which is a different architecture from importing material into KMS for use inside AWS. Relying on automatic rotation for imported material fails by concept because KMS automatic rotation applies only to AWS generated material and cannot replace EXTERNAL material, so expiration without reimport would leave the key unusable. For the exam remember imported keys show EXTERNAL origin and need manual, customer-driven rotation, and in practice verify key state, expiration model, and CloudTrail ImportKeyMaterial events before enabling workloads.