AWS Certified Solutions Architect Associate SAA-C03 Practice Question

Creating a Customer Managed Key in AWS Key Management Service (KMS) and using IAM policies to restrict access to that key to a specific IAM group containing the senior security personnel provides a secure way to allow only authorized staff to manage the keys. This fits the principle of least privilege by specifically designating which IAM identities have permissions to perform key administrative operations. Using AWS managed keys does not provide the same level of granular control over access permissions. Encrypting the keys with another key would add complexity without solving the access control requirement. Rotating keys independently of access policies ensures keys are refreshed regularly but does not address who can manage key permissions.