title: How exactly does encryption key rotation work?
body: <p>How exactly does encryption key rotation work? I understand it's a very good practice to continuously rotate your encryption keys for security purposes, but rotating a key would require too much work.</p>
  <p>Case:</p>
  <p>Let's just say I have a database storing 30GB of data, and we're using an internal key to encrypt data at rest, and I plan to rotate my keys every month.</p>
  <p>Questions:</p>
  <ol>
  <li>Does that mean all my data will be decrypted by the old key and re-encrypted by the new one every month?</li>
  <li>The whole encryption-decryption would take a lot of time and compute resources.</li>
  <li>If my DB ( or any encrypted dataset ) scales tomorrow, does that mean the same process would duplicate when my key rotates? This does not look like a scalable solution.</li>
  </ol>
  <p>Other Details:</p>
  <ol>
  <li>I've also seen AWS KMS rotates it's keys if we've selected the rotation option. How does AWS manage to rotate it's keys and all encrypted data for all the underlying services?</li>
  </ol>