What is the process to rotate the key?
Enable automatic key rotation for the CMK, and specify a period of 6 months.
Create a new CMK with new imported material, and update the key alias to point to the new CMK.
Delete the current key material, and import new material into the existing CMK.
Import a copy of the existing key material into a new CMK as a backup, and set the rotation schedule for 6 months.
Explanations:
AWS KMS does not support automatic rotation for CMKs with imported key material; rotation must be managed manually.
Creating a new CMK with imported material and updating the alias to point to the new CMK is the proper method for manual rotation in this case.
Deleting and re-importing material into the same CMK does not constitute rotation; it merely refreshes the material and retains the same key ID.
Importing material into a new CMK as a backup does not achieve rotation and AWS KMS does not allow setting a rotation schedule for imported material.
I believe the answer is:
Create a new CMK with new imported material, and update the key alias to point to the new CMK.
My best guess is:
Create a new CMK with new imported material, and update the key alias to point to the new CMK.