中文
devexamples
← Workflows

阅读中文版本

Encryption Key Rotation Workflow

Generate a new key version, make new writes use it, rewrap or lazily re-encrypt old data, and retire the old key only when no data depends on it.

advanced~150 minsecurityencryptionoperations

Objective

Rotate an encryption key without re-encrypting everything at once or breaking old data.

Environment

  • A KMS or key store supporting versions
  • Ciphertexts that record the key version

Steps

1. Create a new key version

Create a new key version and keep the old one for decryption.

Expected state: Old data remains readable.

2. Make new writes use the new

Make new writes use the new version.

Expected state: New data is protected by the current key.

3. Rewrap or lazily re-encrypt existing data

Rewrap or lazily re-encrypt existing data over time.

Expected state: Old data migrates at a controlled pace.

4. Retire the old version only after

Retire the old version only after usage telemetry shows zero.

Expected state: No data becomes unreadable.

Decision points

Rewrap data keys or re-encrypt data?

  • Rewrap wrapped keys
  • Re-encrypt plaintext

Rewrap when you use envelope encryption; re-encrypt only if the data key itself is compromised.

Retire old key immediately?

  • After zero usage
  • After a fixed window

Zero usage is safer; a fixed window can leave stragglers that then fail to decrypt.

Expected outcome

All new data uses the new key version, old data is migrated or rewrapped, and the old key is retired with no failed decrypts.

Verification

Confirm decryption failures stay at zero during rotation and that telemetry shows no remaining use of the retired key version.

Cleanup

Record the rotation date and the re-encryption progress for audit.

Overview

Rotate an encryption key without re-encrypting everything at once or breaking old data. Confirm decryption failures stay at zero during rotation and that telemetry shows no remaining use of the retired key version.

Steps

  1. Create a new key version and keep the old one for decryption. Expected state: Old data remains readable.
  2. Make new writes use the new version. Expected state: New data is protected by the current key.
  3. Rewrap or lazily re-encrypt existing data over time. Expected state: Old data migrates at a controlled pace.
  4. Retire the old version only after usage telemetry shows zero. Expected state: No data becomes unreadable.
aws kms create-key --description "app data key v2"
# decrypt with old, encrypt with new
aws kms re-encrypt --ciphertext-blob fileb://wrapped.old \
  --destination-key-id alias/app-v2 --output wrapped.new

Verification

  • All new data uses the new key version, old data is migrated or rewrapped, and the old key is retired with no failed decrypts.

Decision points

  • Rewrap data keys or re-encrypt data? Options: Rewrap wrapped keys; Re-encrypt plaintext. Recommended: Rewrap when you use envelope encryption; re-encrypt only if the data key itself is compromised.
  • Retire old key immediately? Options: After zero usage; After a fixed window. Recommended: Zero usage is safer; a fixed window can leave stragglers that then fail to decrypt.