title: How to do AWS S3 SSE KMS key rotation?
body: <p><strong>Scenario -</strong> <br>
  I created -<br>
   1. One S3 Bucket<br>
   2. Two KMS Keys<br>
   3. Enabled <code>Default encryption</code> on the S3 bucket, using KMS key #1<br>
   4. Uploaded a file in the bucket<br>
   5. Check the object details, it showed the <code>Server-side encryption: AWS-KMS</code> and the <code>KMS key ID: ARN of KMS key #1</code><br>
   6. Changed the <code>AWS S3 Default encryption</code> and now chose <code>KMS key #2</code><br>
   7. The old object still showed <code>KMS key ID: ARN of KMS key #1</code></p>
  
  <p><strong>Questions -</strong><br>
  1. Can the KMS key rotation be done before 1 year?<br>
  2. Is what I did the correct way to rotate an AWS KMS key? If not what's the correct way?<br>
  3. What happens to the older objects of the key gets deleted?</p>