Encryption-key rotation changes which cryptographic material protects new writes. In some managed key systems, rotating material under the same key identifier retains older versions so existing ciphertext remains decryptable. Replacing the key identifier or disabling the old key is a different operation: archived backups and old volumes may still require it. The application must be able to decrypt historical data throughout its retention window.
Make this comfortable
Encryption key rotation: keep old data decryptable during recovery
Operational decision
A claims database and its snapshots use a customer-managed encryption key. Inventory every active volume, backup, export, and regional copy tied to the old key before changing access. The text gate distinguishes an in-place rotation from migration to a new key; provider behavior must be verified for the chosen service. After rotation, encrypt a new test record and decrypt both it and a record written before rotation. Restore an old snapshot into a disposable account with the intended recovery role, then check that the key policy permits the restore path. If moving to a new key identifier, re-encrypt or migrate retained assets on a controlled schedule before revoking the old key. Test a deliberately denied recovery role in the disposable environment to find hidden key dependencies. Do not disable the old key merely because today's application deployment reads and writes successfully.
Claims key transition gate
Old key: active volumes, archives, snapshots inventoried
Change type: material rotation or new key identifier
New write: encrypted and decrypted successfully
Historical read: pre-rotation record decrypted
Recovery: oldest retained snapshot restored with recovery role
Revocation: old key disabled only after dependent assets migrateCost and verification
Keeping historical key material and access paths increases the attack surface and audit burden, but deleting them early can make an immutable backup useless. Re-encryption requires I/O, temporary storage, and time; large archives can outlast a release window. Measure the oldest retained encrypted asset and the exact role required to restore it. Key-rotation success must include a historical decrypt and recovery test, not just a successful new encryption call.
Common Mistakes
- Do not confuse rotation under one key identifier with migration to a new identifier.
- Do not revoke the old key while retained snapshots still require it.
- Do not test only encryption of new records.
Connected lessons
- DevOps: delivery, infrastructure, and reliable operations
- Secrets and configuration across the delivery path
- Secret rotation rollout: update the issuer, consumer, and active connections
- Immutable backup retention: protect recovery copies from deletion
- Backups and disaster recovery: prove the restore path
Practice and check
Object storage follow-up
Cloud authority follow-up
devops
operations