A startup security lead must explain to auditors why some KMS keys show automatic rotation while others need manual handling for an S3 archive. The archive uses customer-supplied key material from a partner HSM. Which distinction between AWS generated and imported key material is accurate for the audit?
Select an answer to reveal the explanation.
Short Explanation
You're making a tricky custody topic audit-ready. The real split is who controls the lifecycle, with imported keys keeping you responsible for refresh and expiry.
Full Explanation
KMS keys with AWS generated material have their cryptographic backing created and stored inside KMS HSMs under AWS custody, enabling optional automatic annual rotation where KMS retains prior versions for decryption, whereas keys with imported material use Origin EXTERNAL where the customer supplies backing bytes, must manage validity through expiration, and must rotate by reimporting new material because automatic rotation is unsupported. Reversing custody and rotation fails by concept because it misattributes HSM control and automation to the wrong origin and contradicts KMS origin behavior. Claiming imported material cannot encrypt S3 or lack auditing fails by concept because once imported, the key functions for envelope encryption and all management APIs are logged to CloudTrail identically. Claiming identical behavior fails by concept because it ignores origin, expiration, and automation differences that auditors specifically test for key provenance. For the exam remember origin determines rotation capability, and in practice check key origin, rotation status, and expiration in KMS console.