Security policy requires annual automatic rotation for customer managed KMS keys that protect citizen PII DynamoDB tables. What should the developer enable?
Select an answer to reveal the explanation.
Short Explanation
Flip automatic rotation on the CMK—KMS keeps the same key ID while rotating backing material yearly. Do not disable keys and rewrite every Lambda, and ROT13 is not encryption. CMKs support automatic rotation.
Full Explanation
KMS customer managed keys support automatic annual rotation that rotates cryptographic material while retaining the same key ID/ARN for applications. Disabling keys and hardcoding new IDs annually is operationally risky. Toy encodings and claims that CMKs cannot rotate are incorrect for meeting a municipal rotation policy.