# Rotating KMS CMKs

* **To create new cryptographic material for your KMS CMKs**, you can:
  * **Create new CMKs**, and then **change your applications or aliases to use the new CMKs**.
  * Enable **automatic key rotation for an existing customer managed CMK**.\\

* When you enable **automatic key rotation for a customer managed CMK, KMS generates new cryptographic material for the CMK every year**.\\

* KMS also **saves the CMK's older cryptographic material in perpetuity so it can be used to decrypt data that it encrypted**.\\

* KMS **does not delete any rotated key material until you delete the CMK**.

* Key rotation **changes only the CMK's backing key, which is the cryptographic material that is used in encryption operations**.
  * The **CMK is the same logical resource**, regardless of whether or how many times its backing key changes:

![](https://40640462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MQ39nPAiP6LTprAFu1T%2F-MSyysXKrNhroWwYYBPG%2F-MSzT7AIvJt2JyxVqR13%2Fimage.png?alt=media\&token=47e62598-7aae-4090-9e12-4f992c7100c8)

| Type of CMK?         | Can manage CMK? | Used only for one AWS account? | Automatic rotation?                  |
| -------------------- | --------------- | ------------------------------ | ------------------------------------ |
| Customer managed CMK | Yes             | Yes                            | Optional. Every 365 days (1 year).   |
| AWS managed CMK      | No              | Yes                            | Required. Every 1095 days (3 years). |
| AWS owned CMK        | No              | No                             | Varies                               |

## How automatic key rotation works

* KMS **supports optional automatic key rotation only for customer managed CMKs**.\\

* **Backing key management.**
  * **KMS retains all backing keys for a CMK, even if key rotation is disabled**.
  * The **backing keys are deleted only when the CMK is deleted**.
  * When you use a CMK to **encrypt, KMS uses the current backing key**.
  * When you use the CMK to **decrypt, KMS uses the backing key that was used to encrypt**.\\

* **Enable and disable key rotation.**
  * **Automatic key rotation is disabled by default on customer managed CMKs**.
  * When you enable key rotation, **KMS automatically rotates the CMK 365 days after the enable date and every 365 days thereafter**.\\

* **AWS managed CMKs.**
  * You **cannot manage key rotation for AWS managed CMKs**.
  * **KMS automatically rotates them every three years** (1095 days).\\

* **AWS owned CMKs.**
  * You **cannot manage key rotation for AWS owned CMKs**.
  * The **key rotation strategy for an AWS owned CMK is determined by the AWS service that creates and manages the CMK**.

## Rotating keys manually

* You **might want to create a new CMK and use it in place of a current CMK instead of enabling automatic key rotation**.\\

* The **process of replacing one CMK with another is known as manual key rotation**.

![](https://40640462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MQ39nPAiP6LTprAFu1T%2F-MSyysXKrNhroWwYYBPG%2F-MSzV4PRVIbnS4G8QeYl%2Fimage.png?alt=media\&token=dfbd2aed-abc5-41bb-8191-786808d09824)

* You **might prefer to rotate keys manually so you can control the rotation frequency**.\\

* It's also a **good solution for CMKs that are not eligible for automatic key rotation:**
  * **Asymmetric CMKs.**
  * **CMKs in custom key stores.**
  * **CMKs with imported key material**.
