Instructor: So let's talk about
an important advanced topic for KMS which is key rotation.
So you can enable automatic key rotation
for a customer-managed CMK, so not an AWS-managed CMK.
And if you enable the automatic key rotation
it will happen every one year.
And after one year, the key will change,
but the previous key will be kept active
so that obviously you can be able to decrypt your old data.
The new key will have the same CMK ID, though.
So that means that only the backing key,
the backing material of the key, will be changed.
So let's take an example.
Here's the backing key and here's the CMK ID.
And so after automatic rotation
which happens every one year,
and you cannot change the period,
it has to be every one year,
then the backing key is going to change,
so the material of the key is going to change.
But the CMK ID remains the same
and the old backing key is going to be saved
so that it can still decrypt the old data.
That's for automatic key rotation.
But you can also rotate your key manually.
For example you want to rotate your key
every 90 days, every 180 days, those kinds of things.
The new key will have a different CMK ID
because you create it manually.
So the idea is that you will keep the previous key active
obviously so that you can decrypt old data,
otherwise you will lose access to all your other old data.
And in this case it is better to use aliases
when you encrypt and decrypt data because if you use aliases
then you hide the change of key for the application
and I will show you this in diagrams.
So it's a good solution to rotate the CMK
that is not eligible for automatic rotation as well,
such as your asymmetric CMK.
So here's an example.
The client is currently talking to alias MyCustomKey
and we have a backing key with the CMK ID.
And then we're going to rotate the key manually
by creating a new key and we're going to change the alias.
And so what happens that there's going to be a new CMK ID.
Your old backing key is still going to be around here, okay,
but now your client thinks that the new alias
is going to point to the new material
and you have done a manual key rotation.
So how does it work to update the alias?
Well you update the alias to hide again
the change to your application
so your application only interacts
from the API perspective with your key alias MyAppKey.
And then the old key, old key alias,
is the one that you had before rotation
and after rotation you're going to create a new key
and you're going to issue an UpdateAlias API code
and this updated alias will have
the alias point to the new key
and therefore from the application perspective
the change will not be detected.
It will just be transparent, okay.
So what you need to remember from an exam perspective
is that if you want to have automatic key rotation,
the period is one year,
but if you want to have manual key rotation
then you can go to 90 days or 180 days
based on the requirements.
And all the extra information I gave you
is just to show you how this would work in real life,
but the exam will not test you on the details
as far as I know, okay?
So that's it for this lecture.
I hope you liked it.
And I will see you in the next lecture.