A network engineer is using AWS Direct Connect connections and MACsec to encrypt data from a corporate data center to the Direct Connect location. The network engineer learns that the MACsec secret key might have been compromised. The network engineer needs to update the connection with an uncompromised secure key. Which solution will meet this requirement?

When a MACsec secret key is compromised, a new, uncompromised key must be generated and associated with the Direct Connect connection. The correct procedure involves using AWS Key Management Service (AWS KMS) with a customer managed key to generate a new MACsec secret key. This process creates a new pre-shared key pair: a Connection Key Name (CKN) and a Connectivity Association Key (CAK). This new CKN/CAK pair is then associated with the Direct Connect connection in the AWS console and configured on the on-premises device to re-establish the secure link. Using an AWS managed key is not supported for this operation.

A. AWS managed keys cannot be used to generate MACsec secret keys for Direct Connect; a customer managed key is required for this specific purpose.
C. You cannot "modify" an existing secret key. Furthermore, re-associating the existing, compromised key pair would not resolve the security issue.
D. The term "modify" is incorrect; a new key must be generated. The process is creation and replacement, not modification of the existing key.

- AWS Direct Connect User Guide. (2023). MACsec security. "To get started with MACsec, you must have a customer managed key."

- AWS Direct Connect User Guide. (2023). Associating a MACsec key. "To associate a MACsec key with a connection... For Secret ARN, choose the secret that you created." This implies creating a new secret (key) to associate.

- AWS Key Management Service Developer Guide. (2023). AWS KMS concepts. This guide distinguishes between AWS managed keys and customer managed keys, clarifying their different use cases and control levels.