Handling S3 KMS CSE key rotation

Question

We are creating S3 objects with KMS managed keys with CSE. I can upload and download the objects via java SDK by building the S3 client using the code below.
`
> 		AmazonS3EncryptionV2 s3Encryption = AmazonS3EncryptionClientV2Builder.standard().withKmsClient(kmsClient)
				.withEncryptionMaterialsProvider(new KMSEncryptionMaterialsProvider(keyAlias))
				.withCryptoConfiguration(new CryptoConfigurationV2().withCryptoMode(CryptoMode.AuthenticatedEncryption))
				.build();

`
Key rotation is enable for the used keys. Will I be able to decrypt the old objects in S3 bucket if the key is rotated and key material is updated? How does KMS know which material to use to decrypt the data key when I have some objects created with before KMS key rotation and some after the rotation ? Is the version of key stored as part of the object metadata? I looked at the metadata of the generated objects and I don't see any metadata that references the version of the key material. Am I missing something about the key management and how they should be used with S3?

Answer

Hi,

From the question I understand that you would like to know if you will be able to decrypt data after the key that was used to encrypt it rotates.

When key rotation occurs, new key material is created and the previous key material is saved so you can decrypt any data that was encrypted with that key. I am attaching the following documentation that goes over this here (1). Key information would be stored in the ciphertextblob which would be how KMS knows the key to use for decryption, I am attaching the following documentation that goes over this here (2). Therefore you would not need to make any changes when the key rotation occurs and all information will still be accessible due to the persistence of the saved key information.

I hope you have a great rest of your day!

References
(1) https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

(2) https://docs.aws.amazon.com/kms/latest/developerguide/programming-encryption.html#decryption

Handling S3 KMS CSE key rotation

Relevant content