A bank keeps the master key for its card-tokenization service in an on-premises hardware security module (HSM). The risk team wants the same key material used as a customer managed symmetric key in AWS KMS, so that the bank's applications can use it without a custom service. The bank security engineer will export the key material from the HSM and import it into KMS.
The bank must keep its own copy of the key material in the HSM, and the plaintext key material must never travel to AWS unprotected.
Which TWO steps are required to import the key material? (Choose two.)
Choose two answers.
AA. Create a symmetric KMS key with an origin of EXTERNAL, and then call GetParametersForImport to receive a wrapping public key and an import token.
BB. Enable automatic key rotation on the key when it is created, so that KMS rotates the imported material every year without further action by the bank.
CC. Upload the plaintext key material to an S3 bucket in the same account, and then set that bucket as the key material source for KMS, so that KMS reads the material from it during the import.
DD. Create the key with an origin of AWS_CLOUDHSM in a CloudHSM cluster, and then move the key material from the on-premises HSM into that cluster to finish the import.
EE. Encrypt the key material on premises with the wrapping public key from KMS, using the RSAES_OAEP_SHA_256 algorithm, and then call ImportKeyMaterial with the matching import token.
Show the answer and explanation
Answers: A, E
A. Right: Correct. A key with an EXTERNAL origin has no key material until the import, and GetParametersForImport returns the public wrapping key and token needed to send it. The bank wraps the material before it leaves its control. Learn more: Importing key material into AWS KMS keys (opens in a new tab)
B. Wrong: KMS does not support automatic rotation for keys with imported key material, so the setting cannot be used here. On-demand rotation is the supported way to replace imported material, and the bank would start it by hand. Learn more: Rotating AWS KMS keys (opens in a new tab)
C. Wrong: KMS does not read key material from S3, and uploading plaintext there would expose the key to anyone with bucket access. This is not a supported import method, so it would fail the protection requirement.
D. Wrong: The AWS_CLOUDHSM origin creates a key inside a CloudHSM cluster for a custom key store, which is a different setup. It does not import the bank's existing key material into a standard customer managed key.
E. Right: Correct. Wrapping the key material with the KMS public key means only KMS can recover it, and ImportKeyMaterial with the matching token completes the import. The token has a limited lifetime, so both calls should run close together. Learn more: Importing key material into AWS KMS keys (opens in a new tab)
Explanation
Importing key material is a two-part process: create the key with an EXTERNAL origin and fetch its wrapping key and token, then wrap the material and send it with ImportKeyMaterial. Automatic rotation is not supported for imported material, and S3 or a CloudHSM origin does not import the bank's key.
Want more on Imported key material and external key stores? The 5 full-length practice sets have 5 more Imported key material and external key stores questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →