AWS KMS is one of the most tested services in the Data Protection domain. The facts below come from the AWS KMS developer guide and focus on what exam questions tend to hinge on: who can use a key, what rotation really changes, and what is reversible.
| Type | Applies to | Notes |
|---|---|---|
| Automatic rotation | Symmetric encryption keys with key material generated by KMS (AWS_KMS origin) | Every 365 days by default, configurable. The key ID does not change. |
| On-demand rotation | Symmetric encryption keys with AWS_KMS origin and with imported (EXTERNAL) key material | Works whether or not automatic rotation is enabled. |
| Manual rotation | Asymmetric keys, HMAC keys and keys in custom key stores | Create a new key and switch the alias or application. |
| AWS managed keys | Keys AWS manages for you | Rotated automatically every year; you cannot enable or disable it. |
Source: docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
Unlike other resource policies, a KMS key policy does NOT automatically grant permissions to the account. Without the statement that allows the account's root principal, IAM policies that allow use of the key are ineffective (IAM policies that deny still work).
Official source: docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
If a key policy gives access to only one user and you delete that user, the key becomes unmanageable and you must contact AWS Support. That is why the default policy includes the account's root principal (arn:aws:iam::ID:root).
Official source: docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
Key administrators manage the key but CANNOT use it in cryptographic operations. Careful: they can change the key policy and create grants, so they can give themselves usage permissions. kms:Delete* does not allow ScheduleKeyDeletion.
Official source: docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
Key users get CreateGrant, ListGrants and RevokeGrant only when the request comes from an integrated AWS service (condition kms:GrantIsForAWSResource). You can limit it to specific services with kms:ViaService.
Official source: docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
Automatic rotation only applies to symmetric encryption keys with key material generated by KMS (AWS_KMS origin). By default it rotates every 365 days and the period is configurable. The key ID does not change and KMS keeps the old material to decrypt.
Official source: docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
Rotation only changes the current key material: it does not rotate data keys or re-encrypt data already protected, and it does not mitigate a compromised data key. Applications and services keep working without changes.
Official source: docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
Asymmetric keys, HMAC keys and keys in custom key stores support neither automatic nor on-demand rotation: rotate them manually by creating a new key (and switching the alias). On-demand rotation does work with imported key material (EXTERNAL).
Official source: docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
KMS automatically rotates AWS managed keys every year (about 365 days) and you cannot enable or disable that rotation. For AWS owned keys, the owning service decides. KMS records the RotateKey event in CloudTrail.
Official source: docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
In multi-Region keys, rotation is a shared property: you enable it and trigger it only on the primary key, and KMS copies the new material to the replicas before using it to encrypt.
Official source: docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
Deleting a KMS key requires a waiting period of 7 to 30 days (30 by default) and is irreversible once it ends. While 'Pending deletion', the key cannot be used for cryptographic operations. If in doubt, disable it: it can be re-enabled.
Official source: docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
During the waiting period you can cancel the deletion and create a CloudWatch alarm that warns you if someone or something tries to use the key. It is logged in CloudTrail when scheduled and when deleted. Only customer managed keys can be deleted.
Official source: docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
With an asymmetric ENCRYPT_DECRYPT key, anyone holding the public key can keep encrypting outside KMS without notice, and that data cannot be decrypted after deletion. Alarms cannot detect use of the public key. Consider disabling it.
Official source: docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
With imported key material you remain responsible for the material, but KMS uses a copy. It cannot be imported into custom key stores. It is useful to prove the entropy source or to set an expiration and be able to delete it manually.
Official source: docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
Deleting imported key material is temporary and reversible: you import it again. Deleting the KMS key (after 7-30 days) is irreversible. With expired or deleted imported material, the key is unusable until you reimport it.
Official source: docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
A symmetric ciphertext is cryptographically bound to its KMS key: even if you recreate a key with the same material, it cannot decrypt it. With asymmetric or HMAC keys you can recreate an equivalent one (with a different key ID).
Official source: docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
Create a CloudWatch alarm that warns you when imported material is about to expire: when any material expires or is deleted, the KMS key stops working. You can also reimport it or import new material for on-demand rotation.
Official source: docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
Answer practice questions, then review your mistakes with spaced repetition.