Imported key material and external key stores: SCS-C03 study notes and practice questions
What to know about Imported key material and external key stores for the SCS-C03 exam, from the Data Protection domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a rule such as “we must generate our own keys” or “keys must never reside in AWS,” then ask which key origin satisfies it and what it costs in rotation and availability.
Key origins
KMS-generated material is the default. AWS generates it inside KMS hardware. Symmetric keys with KMS material can rotate automatically, on a period you choose from 90 to 2,560 days, and on demand.
Imported key material (BYOK) means you generate the key outside KMS and import it using a wrapping key. You can set an expiration time for the material. Automatic rotation is not supported for imported material, but you can rotate it on demand by importing new material. You cannot export the key from KMS.
CloudHSM custom key store keeps KMS key material in a CloudHSM cluster in your account. The hardware is single-tenant, and you manage the cluster and its availability.
External key store (XKS) keeps key material in an external key manager outside AWS. KMS calls that system for each cryptographic operation, so availability and latency depend on it.
Keys in a CloudHSM or external key store do not support automatic rotation.
Asymmetric and HMAC keys do not rotate automatically. You rotate them by creating a new key and updating the alias or the application’s reference.
How to choose
Scenario wording
Pick
Keys generated by the company, then imported into KMS
Imported key material
Keys must sit in hardware the company runs in its own cluster
CloudHSM custom key store
Keys must never be stored in AWS
External key store
Standard encryption with automatic rotation
KMS-generated symmetric key
Rotate imported key material now
On-demand rotation with newly imported material
Common traps
Assuming imported keys rotate automatically. They do not.
Losing imported material. Keep a copy outside AWS. If the material is deleted, data encrypted with it is unreadable until the same material is imported again.
Choosing XKS for speed. External key stores add latency and a dependency. They fit data-location rules.
Choosing CloudHSM by default. It is more work to run. A customer managed KMS key is usually enough for “the customer controls the key.”
Expecting XKS to survive an external outage. Operations fail when the external store cannot be reached.
A bank keeps the master key for its card-tokenization service in an on-premises hardware security module (HSM). The risk team wants the same key material used as a customer managed symmetric key in AWS KMS, so that the bank's applications can use it without a custom service. The bank security engineer will export the key material from the HSM and import it into KMS.
The bank must keep its own copy of the key material in the HSM, and the plaintext key material must never travel to AWS unprotected.
Which TWO steps are required to import the key material? (Choose two.)
Choose two answers.
AA. Create a symmetric KMS key with an origin of EXTERNAL, and then call GetParametersForImport to receive a wrapping public key and an import token.
BB. Enable automatic key rotation on the key when it is created, so that KMS rotates the imported material every year without further action by the bank.
CC. Upload the plaintext key material to an S3 bucket in the same account, and then set that bucket as the key material source for KMS, so that KMS reads the material from it during the import.
DD. Create the key with an origin of AWS_CLOUDHSM in a CloudHSM cluster, and then move the key material from the on-premises HSM into that cluster to finish the import.
EE. Encrypt the key material on premises with the wrapping public key from KMS, using the RSAES_OAEP_SHA_256 algorithm, and then call ImportKeyMaterial with the matching import token.
Show the answer and explanation
Answers: A, E
A. Right: Correct. A key with an EXTERNAL origin has no key material until the import, and GetParametersForImport returns the public wrapping key and token needed to send it. The bank wraps the material before it leaves its control. Learn more: Importing key material into AWS KMS keys (opens in a new tab)
B. Wrong: KMS does not support automatic rotation for keys with imported key material, so the setting cannot be used here. On-demand rotation is the supported way to replace imported material, and the bank would start it by hand. Learn more: Rotating AWS KMS keys (opens in a new tab)
C. Wrong: KMS does not read key material from S3, and uploading plaintext there would expose the key to anyone with bucket access. This is not a supported import method, so it would fail the protection requirement.
D. Wrong: The AWS_CLOUDHSM origin creates a key inside a CloudHSM cluster for a custom key store, which is a different setup. It does not import the bank's existing key material into a standard customer managed key.
E. Right: Correct. Wrapping the key material with the KMS public key means only KMS can recover it, and ImportKeyMaterial with the matching token completes the import. The token has a limited lifetime, so both calls should run close together. Learn more: Importing key material into AWS KMS keys (opens in a new tab)
Explanation
Importing key material is a two-part process: create the key with an EXTERNAL origin and fetch its wrapping key and token, then wrap the material and send it with ImportKeyMaterial. Automatic rotation is not supported for imported material, and S3 or a CloudHSM origin does not import the bank's key.
Want more on Imported key material and external key stores? The 5 full-length practice sets have 5 more Imported key material and external key stores questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Imported key material and external key stores