title: How does Amazon SSE-S3 key rotation work?
body: <p>I'm trying to wrap my mind around Amazon's Server Side Encryption options so I can start asking S3 to encrypt my data at rest when my applications upload files.</p>
  
  <p>So far the AWS-Managed Encryption Keys option sounds like what I'm looking for (<a href="https://media.amazonwebservices.com/AWS_Securing_Data_at_Rest_with_Encryption.pdf" rel="noreferrer">Model C</a>):</p>
  
  <p><img src="https://i.stack.imgur.com/KYgry.jpg" alt="enter image description here"></p>
  
  <p>But then it says </p>
  
  <blockquote>
    <p>As an additional safeguard, this key itself is encrypted with a
    periodically rotated master key unique to Amazon S3 that is securely
    stored in separate systems under AWS control.</p>
  </blockquote>
  
  <p>How does this rotation work? Does this mean that every time AWS rotates their key-encrypting key, they have to re-encrypt EVERY SINGLE <code>Data Key</code> stored in S3???</p>
  
  <p>That seems crazy to me, and I don't want to sound crazy when I try to convince my boss that this is a good idea :)</p>