Renames current key to "<current_name> (rotated at activation_date
, deactivation_date
, state
, rsa
,
aes
, aria
, des
, des3
, seed
, dsa
, kcdsa
, eckcdsa
,
pub_exponent
, elliptic_curve
, key_size
, key_ops
, description
,
enabled
, custom_metadata
, publish_public_key
, rotation_policy
.
If the key is an external key, additional changes might happen (like changes to aws-alias custom_metadata, etc). (yet to be documented)
For AWS KMS keys, a new key is generated in the external KMS and
after the rotation, the new key will have the original aliases and the old
key's aliases will have (rotated at
For Tokenization Keys fpe
subobject should be null or
excluded to allow existing fpe policy to be copied to the new key.
Note: Key rotation requires that Encryption calls be made using Key name and the corresponding returned Key UUID be stored with the encrypted value.
If the encrypting key UUID is lost, then the encrypted data can no longer reliably be decrypted after the key is rotated.
Success result