{
  "slug": "key-rotation",
  "term": "Key rotation",
  "aliases": [
    "Cryptographic key rotation"
  ],
  "definition": "Key rotation replaces the key or key material selected for new cryptographic operations without necessarily removing earlier decryption keys.",
  "note": "Separate the layers: activating a new wrapping-key version, rewrapping existing data-encryption keys and re-encrypting payloads with new data keys are different actions. A completed rotation need not perform either migration. [rotation-guide] [envelope-guide]\n\nManaged-key example: rotation can change current KMS key material while the same logical key still decrypts old ciphertext using earlier material. It does not rotate existing data keys, rewrite protected data or remedy compromise of a data key. [kms-rotation]\n\nService integration: the cited customer-managed encryption-key (CMEK) integrations can automatically rewrap existing DEKs, use the new primary only for subsequent encryption, or continue using the originally configured version. Automatic migration may take time. A KMS rotation event alone therefore does not establish which resource versions migrated; check the documented behavior for that resource type. [cmek-rotation]\n\nMigration and retirement: the cited re-encryption workflow decrypts with the prior version and encrypts with the new primary version. Retiring a version before all required data can be recovered without it risks permanent data loss. [reencrypt-guide] [rotation-guide]\n\nAssessment: a rotation log establishes a key-management event, not that old ciphertext, wrapped-key copies or usable decryption keys disappeared. Record which layer changed and which recovery paths remain. [rotation-guide] [kms-rotation]",
  "status": "shipping",
  "advantages": [],
  "limitations": [],
  "related": [
    "envelope-encryption",
    "cryptographic-erase"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "envelope-guide",
      "title": "Google Cloud KMS: Envelope encryption, data keys and key-encryption keys",
      "url": "https://docs.cloud.google.com/kms/docs/envelope-encryption",
      "accessed": "2026-11-14"
    },
    {
      "id": "rotation-guide",
      "title": "Google Cloud KMS: Key rotation, after you rotate keys",
      "url": "https://docs.cloud.google.com/kms/docs/key-rotation",
      "accessed": "2026-11-14"
    },
    {
      "id": "kms-rotation",
      "title": "AWS KMS: Rotate KMS keys, current material and unchanged data keys",
      "url": "https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html",
      "accessed": "2026-11-14"
    },
    {
      "id": "reencrypt-guide",
      "title": "Google Cloud KMS: Re-encrypting data, workflow",
      "url": "https://docs.cloud.google.com/kms/docs/re-encrypt-data",
      "accessed": "2026-11-14"
    },
    {
      "id": "cmek-rotation",
      "title": "Google Cloud KMS: CMEK key rotation, integration patterns and resource-specific behavior",
      "url": "https://docs.cloud.google.com/kms/docs/cmek-rotation",
      "accessed": "2026-11-15"
    }
  ],
  "updated": "2026-11-15",
  "provenance": [
    "The managed-key example is AWS KMS rotation. Google Cloud KMS supplies migration, retirement and resource-specific CMEK integration guidance; these behaviors do not describe every key-management API.",
    "Source synthesis only; no cloud account, key, ciphertext or storage device was modified."
  ]
}