A key without rotation = a compromised key is valid forever. Regular rotation limits the impact of a potential leak.

Why Rotate¶

• Limiting exposure time in case of compromise
• Compliance requirements (PCI DSS: annually)
• Reducing the amount of data encrypted with a single key
• Departure of employees with access

AWS KMS Automatic Rotation¶

Key Rotation — Rotating Cryptographic Keys¶

resource “aws_kms_key” “main” { enable_key_rotation = true # Rotation every year }

Manual rotation¶

aws kms create-key –description “new-key”

Re-encrypt data with the new key¶

Envelope Encryption¶

Data is encrypted with a Data Encryption Key (DEK). The DEK is encrypted with a Key Encryption Key (KEK) in KMS. You rotate the KEK — re-wrap the DEK, not re-encrypt all data.

Key Takeaway¶

Automatic rotation via KMS. Envelope encryption for efficient rotation. Maintain a grace period for old keys.