A team enables automatic key rotation, using the default settings, on a symmetric customer managed KMS key whose key material AWS KMS generated. They also have a separate asymmetric customer managed KMS key that they would like to rotate on a similar automatic schedule. What should they expect?
- The symmetric key rotates automatically every 365 days unless a custom rotation period between 90 and 2560 days is specified; the asymmetric key is not eligible for automatic or on-demand rotation and must instead be rotated manually by creating a new key and updating references to it
- Both keys rotate automatically every 365 days once automatic rotation is enabled, because AWS KMS treats every customer managed key type identically for rotation purposes
- Neither key can ever have its key material rotated after creation; the only way to rotate is to close the account and open a new one
- The asymmetric key rotates automatically every 90 days by default, while the symmetric key requires manual rotation because it holds the material actually used to encrypt data
Why A? And why not the others?
Correct answer: A. The symmetric key rotates automatically every 365 days unless a custom rotation period between 90 and 2560 days is specified; the asymmetric key is not eligible for automatic or on-demand rotation and must instead be rotated manually by creating a new key and updating references to it
Automatic key rotation is supported only for symmetric encryption KMS keys with AWS KMS-generated key material; the default rotation period is 365 days, but a custom rotation period anywhere from 90 to 2560 days can be specified instead. Asymmetric KMS keys are explicitly excluded from both automatic and on-demand rotation and can only be rotated manually, by creating a new key and migrating callers to it. The option claiming both key types rotate identically is wrong because it ignores this explicit exclusion of asymmetric keys from automatic rotation. The option claiming rotation is impossible without recreating the entire account is wrong because automatic rotation is a normal, supported, ongoing feature for eligible keys that never requires account-level changes. The option reversing which key type gets automatic rotation is wrong because it is the symmetric key, not the asymmetric one, that is eligible for the automatic schedule, and there is no built-in 90-day default schedule for asymmetric keys at all.
Source: AWS KMS documentation: Rotate AWS KMS keys (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)