A police evidence bucket is encrypted with a customer managed KMS key. Policy requires automatic annual rotation of that CMK, and TLS certificates for related portals must stay current. Which approach best addresses key rotation for the CMK?
Select an answer to reveal the explanation.
Short Explanation
Automatic CMK rotation is like changing the evidence-room lock on a yearly schedule without re-boxing every folder by hand—KMS handles the key versioning. Pair that with ACM renewals so the web doors stay trustworthy too.
Full Explanation
Police evidence buckets encrypted with a customer managed KMS key should enable automatic annual rotation on that CMK so AWS generates new key material yearly while retaining previous versions needed to decrypt older ciphertext—without operators re-encrypting every object by hand. Treating ACM certificate renewal for related portals as complementary hygiene keeps TLS endpoints trustworthy on a parallel lifecycle. Together, automatic CMK rotation and managed certificate renewal address "keys and certs go stale" risk for evidence systems that must remain readable for years yet cryptographically current.
Never rotating the CMK and embedding a 50-year self-signed certificate in every browser fails key hygiene and trust distribution; browsers and policies expect managed rotation and publicly trusted certs. Deleting the CMK weekly without a re-encrypt/retention plan fails availability of historical evidence—ciphertext becomes permanently unrecoverable, which is catastrophic for chain-of-custody archives. Disabling KMS and switching to unencrypted AES keys on a whiteboard fails confidentiality and key custody completely.
Exam caveat: automatic annual rotation rotates the CMK backing material; it is not the same as re-encrypting every S3 object with a brand-new key ARN, and deleting a CMK is irreversible after the waiting period—prefer rotation over deletion. Operational check: enable automatic rotation on the evidence CMK, verify the rotation status in the KMS console/API, decrypt an older object after a rotation event (or documented version behavior), and confirm ACM-managed portal certificates show successful renewal.