A government contractor must use KMS keys with key material generated in its on-premises HSM, retain control over material lifetime, support manual rotation annually, and optionally enforce that AWS never stores material durably. Cloud-generated keys are prohibited. Which imported key material design meets the external control requirements for the workload?
Select an answer to reveal the explanation.
Short Explanation
You kept the crown jewels minted at home. Bringing your own material with expiry keeps control in your HSM, and imported keys let you rotate on your terms.
Full Explanation
KMS supports bring-your-own-key by importing externally generated key material with an optional expiration after which KMS deletes the material until you reimport it, and rotation by importing new key material (on-demand rotation), while KMS External Key Store backed by an external manager keeps durable material outside AWS for stricter sovereignty needs. AWS-generated KMS material violates the prohibition on cloud-generated keys despite supporting automatic rotation. CloudHSM provides dedicated HSM clusters but is a separate service from KMS imported material, and disabling key policies breaks authorization rather than proving external control. Secrets Manager stores secrets and cannot supply KMS key material or enforce cryptographic operations under KMS key policies. For the exam, link on-premises HSM and lifetime control to BYOK import with expiration or XKS, and in practice track expiration alarms and test reimport before expiry.