Key Rotation
Data ProtectionKey Rotation is the practice of periodically replacing cryptographic keys with new key material. This limits the amount of data encrypted under any single key and reduces the impact if a key is compromised.
AWS KMS Key Rotation
- Automatic rotation generates new key material on a configurable schedule (default: annually, range: 90 days to 7 years)
- The key ID and ARN stay the same - no application changes needed
- Old key material is preserved so previously encrypted data can still be decrypted
- On-demand rotation also available (rotate immediately)
Related AWS Services
Related Terms
A cryptographic key managed by AWS Key Management Service used to encrypt and decrypt data across AWS services, with centralized key policies and automatic rotation.
The practice of regularly replacing access keys, passwords, and secrets with new values to limit the window of exposure if a credential is compromised.
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.