Let's quickly go through some of the important points related to AWS KMS key rotation:
- Automatic key rotation every year (365 days) is only supported for CMKs with AWS key materials.
- We can do a manual key rotation for CMKs with AWS key material if we want a different duration for the key rotation.
- With automatic key rotation, only CMK is rotated and not the data keys.
- With automatic key rotation, new encryptions are made using the new backing key. However, data encrypted using an older backing key is decrypted using that key. For this purpose, AWS keeps all backing keys available until we delete the CMK.
- With automatic key rotation, even if we disable key rotation, old backing keys will still be available to decrypt data ...