What should be done to accomplish this?
Back up the current KMS key and enable automatic key rotation.
Create a new key in AWS KMS and assign the key to Amazon EBS.
Enable automatic key rotation of the EBS volume key in AWS KMS.
Upload new key material to the EBS volume key in AWS KMS to enable automatic key rotation for the volume.
Explanations:
Enabling automatic key rotation in AWS KMS does not require manually backing up the key. AWS KMS manages key rotation automatically, so backing up the current key is unnecessary.
Creating a new KMS key and assigning it to the EBS volume would require re-encrypting the volume. This would not allow the current key to remain usable for the encrypted volume.
Enabling automatic key rotation for the KMS key used to encrypt the EBS volume allows for seamless key rotation while ensuring the volume remains readable with the existing key.
Uploading new key material is not necessary to enable automatic key rotation in AWS KMS. AWS KMS handles key rotation automatically when enabled for the key, and this step would be inappropriate for automatic key rotation.
As I recall, the answer is:
Enable automatic key rotation of the EBS volume key in AWS KMS.
I reckon the answer is:
Enable automatic key rotation of the EBS volume key in AWS KMS.