AWS Certified Developer Associate DVA-C02 Practice Question

The most efficient way to meet the requirement for annually changing the underlying key is to enable automatic key rotation on the customer-managed KMS key. AWS KMS will then automatically generate a new backing key each year. The key ID of the customer-managed key remains the same, ensuring no application changes are needed to use the new backing key. Manually creating a new key each year and updating the application's configuration is a valid approach but incurs significant operational overhead. Key policies are used to define permissions for the key, not to configure a rotation schedule. Creating a new alias is for providing a friendly name to a key and does not rotate the underlying cryptographic material.