A police evidence bucket is encrypted with a customer managed KMS key. Policy requires automatic annual rotation of that CMK, and TLS certificates for related portals must stay current. Which approach best addresses key rotation for the CMK?
Select an answer to reveal the explanation.
Short Explanation
Automatic CMK rotation is like changing the evidence-room lock on a yearly schedule without re-boxing every folder by hand—KMS handles the key versioning. Pair that with ACM renewals so the web doors stay trustworthy too.
Full Explanation
KMS supports automatic yearly rotation for customer managed symmetric keys, which refreshes key material while retaining access to historically encrypted objects under prior key versions. ACM manages certificate renewal for TLS endpoints. Skipping rotation, destructive weekly deletion without a plan, or abandoning encryption undermines evidence protection.