Municipal app config currently hard-codes raw KMS key IDs. Operators want rotations and re-pointing without hunting every service for ARNs. What practice helps?
Select an answer to reveal the explanation.
Short Explanation
A KMS alias is the labeled hook on the wall—point services at alias/city-pii and rehang the key when you rotate or swap. Hard-coding raw key IDs everywhere turns every change into a scavenger hunt. Cleartext keys in env vars are worse.
Full Explanation
KMS aliases provide a stable name applications can reference while the underlying key target can be updated operationally. Preferring aliases in configuration reduces the need to change every hard-coded key ID or ARN during rotations or re-pointing. Storing CMK material in Secrets Manager or cleartext environment variables is incorrect.