The correct answer is: Create an AWS Key Management Service (AWS KMS) customer managed key, enable automatic key rotation, and configure the S3 buckets default encryption to use the KMS key before uploading the data.

Customer managed KMS keys provide full control over key permissions and policies and support automatic key rotation on an annual basis. By configuring S3 to use this key as the default encryption mechanism, all uploaded data is automatically encrypted at rest with the rotating KMS key. This approach satisfies both the encryption and rotation requirements while minimizing operational effort.

Why the other options are incorrect:

SSE-S3 (S3 managed keys) encrypts data at rest but does not give you control over the key or its rotation schedule. AWS manages those keys and rotates them at its own discretion. It does not meet compliance requirements where customer-controlled rotation is necessary.

Using a customer managed key without enabling automatic rotation would require manual rotation every year, which introduces avoidable operational overhead and the risk of missing rotation deadlines.

Encrypting data manually before uploading and importing key material into a KMS key significantly increases complexity and is generally only required in regulated environments where external key management is needed. It also does not support automatic key rotation for imported keys.

Why this question matters: This scenario tests your understanding of S3 encryption options, key management practices, and how to balance compliance with operational simplicity using AWS-managed services.

Tip: When encryption and compliance (like annual rotation) are required, use KMS customer managed keys with automatic rotation. Avoid manual key rotation and pre-encryption unless youre meeting very specific regulatory controls.

Full AWS Practitioner Certification Question