Question

A security team enables automatic annual key rotation on a customer managed AWS KMS symmetric key that has been used for two years to encrypt objects in an S3 bucket. After rotation occurs, an auditor asks whether previously encrypted objects will remain readable and how the older key material is handled. What is the correct behavior of KMS automatic key rotation in this situation?

Accepted Answer

KMS retains the old key material and uses it to decrypt objects encrypted before rotation, while new encryptions use the new key material; all objects remain readable with no re-encryption required.

Answer

KMS re-encrypts all existing S3 objects with the new key material automatically, so applications must not access objects until re-encryption completes.

Answer

The old key material is permanently deleted after rotation, so objects encrypted before rotation must be manually re-encrypted or they become unreadable.

Answer

Rotation creates a new key with a different key ID, so all references to the old key ARN in bucket policies and applications must be updated to avoid access failures.