A company uses AWS KMS with CMKs and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days. Which solution will accomplish this?
A) Configure AWS KMS to publish to an Amazon SNS topic when keys are more than 90 days old.
B) Configure an Amazon CloudWatch Events event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon SNS topic.
C) Develop an AWS Config custom rule that publishes to an Amazon SNS topic when keys are more than 90 days old.
D) Configure AWS Security Hub to publish to an Amazon SNS topic when keys are more than 90 days old.

Question

Quizplus · Accepted Answer

AWS Config can be used to create custom rules that evaluate the configuration of AWS resources, such as KMS keys, and can trigger notifications via SNS when specific conditions, like keys not being rotated after 90 days, are met.

A Company Uses AWS KMS with CMKs and Manual Key