Key Rotation

Key Rotation is the practice of periodically replacing cryptographic keys with new key material. This limits the amount of data encrypted under any single key and reduces the impact if a key is compromised.

AWS KMS Key Rotation

• Automatic rotation generates new key material on a configurable schedule (default: annually, range: 90 days to 2560 days, about 7 years)
• The key ID and ARN stay the same - no application changes needed
• Old key material is preserved so previously encrypted data can still be decrypted
• On-demand rotation also available (rotate immediately, up to 25 times per key)

What Rotation Does and Does Not Do

KMS rotation swaps the current key material inside the same logical key: new encrypt operations use the new material, while decryption transparently selects whichever historical material encrypted the ciphertext. KMS retains all previous key material until the key itself is deleted, which is why nothing breaks and no re-encryption happens. That last point is the one people miss: rotation does not re-encrypt existing data and does not rotate the data keys your KMS key has generated. If a data key or ciphertext was compromised, rotating the KMS key above it changes nothing about that exposure; you have to re-encrypt the affected data.

Eligibility differs by key type. Automatic rotation applies only to symmetric encryption keys with KMS-generated material. On-demand rotation also covers symmetric keys with imported material. Asymmetric keys, HMAC keys, and keys in custom key stores support neither and must be rotated manually, meaning you create a new key and repoint your alias or application. AWS managed keys (the aws/service ones) rotate automatically every year and you cannot change that schedule. One pricing note: KMS bills a monthly fee for the first and second rotated key material versions of a customer managed key, capped at the second; further rotations add nothing.

How It Goes Wrong in Practice

The classic compliance failure is checkbox rotation. A policy mandates annual key rotation; the team enables KMS automatic rotation everywhere and reports the requirement met. But the requirement, as written for most frameworks, is about limiting how much data any single key protects and bounding compromise impact, and KMS rotation only does that for data encrypted after the rotation date. Teams have then been surprised during audits or incidents to learn that years of stored objects were still protected by data keys minted under the original material, and that a leaked data key remained fully usable. The complementary mistake runs the other direction: manually rotating by creating a new KMS key and then scheduling deletion of the old one, without realizing every object encrypted under the old key just became unrecoverable on deletion day. With native rotation this cannot happen (material is retained); with manual rotation, key deletion is data destruction and needs to be treated with that level of care.

Practical Check: Enable and Verify Rotation

Enable automatic rotation with a custom period on a customer managed key:

aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --rotation-period-in-days 180

The --rotation-period-in-days parameter accepts 90 to 2560 and defaults to 365 when omitted; the command produces no output on success. Verify the configuration:

aws kms get-key-rotation-status --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

The response shows KeyRotationEnabled, RotationPeriodInDays, and NextRotationDate. To rotate immediately, for example after a scare or to prove the capability to an auditor:

aws kms rotate-key-on-demand --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

On-demand rotation is limited to 25 per key and does not disturb the automatic schedule. Rotation events are also written to CloudTrail and EventBridge, so you can alert on them.

Frequently Asked Questions

Will rotation break my application or require code changes?

No. The key ID, ARN, aliases, and policies are unchanged; KMS automatically uses the right material version for each decrypt. That transparency is the main argument for native rotation over do-it-yourself key replacement.

Does rotating a KMS key protect me if a data key leaked?

No. Rotation changes the wrapping key going forward, but existing data keys and existing ciphertext are untouched. A compromised data key requires re-encrypting the data it protected with a fresh data key.

Can I rotate keys with imported key material?

Automatic rotation is not available for imported (EXTERNAL origin) material, but on-demand rotation is supported for symmetric encryption keys with imported material; you import the new material yourself and manage expiration. For asymmetric and HMAC keys, rotation is manual: create a new key and repoint the alias.