Exam AWS Certified Security - Specialty topic 1 question 291 discussion

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/import-key-material.html aws kms import-key-material \ --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \ --encrypted-key-material fileb://EncryptedKeyMaterial.bin \ --import-token fileb://ImportToken.bin \ --expiration-model KEY_MATERIAL_EXPIRES \ --valid-to 2021-09-21T19:00:00Z

Correct answer is A. You can select your KMS key with imported key material expiration date. https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-managing.html

Selected A

B, A requires manual rotation

Not A Manual rotation is a good choice when you want to control the key rotation schedule. It also provides a way to rotate KMS keys that are not eligible for automatic key rotation, including asymmetric KMS keys, HMAC KMS keys, KMS keys in custom key stores, and KMS keys with imported key material.

I agree on option A - KMS CMK

Just did it with external key material. Expiration option available on the last screen

Key Rotation 90 days --> It has to be Customer Managed Key with Imported Key Material. Option A

answer A. go to AWS KMS console and try to configure AWS CMK with external key. The option to set expiration date is available at the end of last step where the key is uploaded to CMK.

"A"- adjusting expire dates can only be oone with imported key material, not AWS provided. From the link below "When you import key material, you can optionally specify a time at which the key material expires. When the key material expires, AWS KMS deletes the key material and the KMS key becomes unusable. To use the KMS key again, you must reimport key material."

A......... https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html

A..........