No. Rotating a managed KMS key creates new key material for future encryption. It does not re-encrypt existing data and does not rotate the data keys the KMS key already produced. AWS says rotation will not mitigate the effect of a compromised data key.
What AWS says rotation does
By AWS KMS documentation, automatic rotation of a customer managed key generates new cryptographic material every year by default, and you can set a custom period. The key ID and ARN stay the same. Decryption automatically uses whichever key material encrypted the ciphertext, so applications need no code changes.
AWS also keeps all older key material for keys it generated, until you delete the key.
What it does not do
- It does not rewrite stored ciphertext.
- It does not change data keys that were already generated and stored in encrypted form.
- It does not help if an attacker has a plaintext data key.
- It only applies automatically to symmetric encryption keys with AWS generated material. Asymmetric keys, HMAC keys and keys in custom key stores need manual rotation.
AWS notes that KMS keys usually act as wrapping keys, used rarely, so exhaustion risk is very low. Many teams rotate because a contract or regulation says so. AWS says you may be compelled to rotate for business, contract or government rules.
When you need a real re-encryption
OWASP's cryptographic storage guidance lists triggers for rotating keys: suspected compromise (including when someone with key access leaves), cryptoperiod expiry, approaching usage limits, or a major weakness announced in the algorithm. For these, OWASP's preferred approach is to decrypt and re-encrypt existing data under the new key, keeping retired keys for a time so old backups can still be read.
With envelope encryption, a cheaper path exists for KEK changes: re-wrap the stored data keys under the new wrapping key. OWASP's key management guidance notes that re-wrapping does not reset data key cryptoperiods or usage limits.
A practical rule
- Turn on automatic rotation for wrapping keys where supported. It is cheap and meets most rules.
- Write down in your policy what rotation means: key material only, not data.
- After a suspected leak, treat it as an incident: revoke, then re-encrypt affected data.
- Log rotations. AWS emits an event to CloudTrail and EventBridge for each one.
Why the confusion is common
The word rotation suggests everything gets refreshed. In practice only the current key material changes. AWS describes the KMS key as the same logical resource however many times its material changes, with properties unchanged. That is helpful for operations, since nothing breaks, but it means a rotation report is evidence of a schedule being followed, not evidence that data was re-protected. If an auditor asks what rotation covers, answer precisely: new encryptions use new material, old ciphertext still decrypts with old material, and a separate re-encryption project exists for the cases that need it.
Quick check
If I rotate monthly, is old data safer?
Not by itself. Old ciphertext remains under the old key material, and that material is retained so it can be decrypted.
Does rotation break my application?
Not for supported AWS keys. Decryption picks the right key material automatically.
Related: envelope encryption explained.
Sources
- AWS KMS: Rotate AWS KMS keys
- OWASP Cryptographic Storage Cheat Sheet
- OWASP Key Management Cheat Sheet
Last reviewed: 19 October 2026.
