Enable Automatic KMS Key Rotation
A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?
Quick Answer
The answer is to enable automatic key rotation on the customer-managed KMS key. This is the correct action because AWS KMS handles annual rotation automatically for customer-managed keys, rotating the underlying cryptographic material each year while preserving the same key ID and ARN, so all existing encrypted data in S3 remains accessible without any application changes. On the AWS Certified Developer Associate DVA-C02 exam, this concept tests your understanding of the distinction between automatic rotation (available only for customer-managed keys) and manual rotation (required for AWS managed keys or imported key material). A common trap is assuming you must create a new key or rotate the key alias, but the exam expects you to know that enabling automatic rotation satisfies a yearly rotation policy with zero operational overhead. Memory tip: think “auto-annual” for customer-managed keys—AWS handles the yearly turnover, you just flip the switch.
⚠ Common exam trap
It's easy for candidates to think manual rotation or creating a new key is required because they confuse KMS key rotation with S3 bucket key rotation or assume that automatic rotation changes the key ID, which would break references to the key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation
AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually rotate the KMS key every year
Why it's wrong here
Manual rotation leaves the schedule to human action, so keys can exceed the yearly interval unnoticed. Enabling automatic rotation on the KMS key lets AWS rotate the backing material annually. Manual rotation suits imported key material, which KMS cannot rotate automatically.
- ✗
Create a new KMS key and update all applications to use it
Why it's wrong here
Creating a replacement key and re-pointing applications is manual key replacement, not rotation; it leaves old ciphertext under the original key and demands re-encryption effort. Automatic annual rotation is a property configured on the existing KMS key itself, which generates new backing key material while retaining the same key ID and ARN.
- ✓
Enable automatic key rotation
Why this is correct
Automatic key rotation re-wraps the KMS key material annually without changing the key ID or ARN, so existing ciphertext and applications continue working. Enabling it on each customer managed key meets the yearly rotation requirement with no manual intervention.
- ✗
Use AWS CloudWatch Events to trigger a Lambda function that rotates the key
Why it's wrong here
AWS KMS does not support rotating a customer managed key via a Lambda function; key rotation is an internal KMS operation that can only be enabled or disabled through the key's rotation configuration, not triggered externally. This option is tempting because CloudWatch Events and Lambda are commonly used to automate periodic tasks, and in scenarios requiring custom cryptographic key rotation outside KMS (e.g., for client-side encryption keys), that combination would be the correct approach.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?
hard- A.Use AWS managed keys instead of customer managed keys
- B.Rotation is enabled by default for all KMS keys
- ✓ C.Enable automatic key rotation in the KMS key settings
- D.Create a new key and update the alias to point to the new key annually
Why C: Customer managed KMS keys support optional automatic key rotation, which must be explicitly enabled in the key's settings. Once enabled, AWS rotates the backing key material every 365 days (or a custom period of 90–2560 days) while preserving the same key ID, ARN, and alias, so existing ciphertext remains decryptable. Enabling rotation in the KMS key settings is therefore the correct action.
Variation 2. A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated every 90 days. Which key type should the company use to meet this requirement with minimal operational overhead?
medium- A.Customer managed KMS key with manual rotation
- ✓ B.Customer managed KMS key with automatic rotation enabled
- C.AWS managed KMS key
- D.AWS owned KMS key
Why B: Customer managed KMS keys support automatic rotation with a configurable rotation period. You can set the rotation period to 90, 180, or 365 days when enabling automatic rotation. This allows the company to meet the 90-day rotation requirement with minimal operational overhead, as AWS handles the rotation automatically. AWS managed keys and AWS owned keys do not allow custom rotation periods, and manual rotation (option A) requires significant overhead.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.