AWS Payment Cryptography

Payment keys don't rotate in the same way that KMS keys do. However, there are a several use cases where it is applicable as noted below.

Main Key rotation - AWS takes responsibility for rotation of main keys and any working keys are protected by the main keys. https://docs.aws.amazon.com/payment-cryptography/latest/userguide/cryptographic-details-internalops.html

Transport Key Rotation - Some payment schemes and counter parties may rotate these keys (such as Zone Pin Keys) on a periodic basis such as every 24 hours. One party will initiate the key update by creating a new key and notifying the other side. Upon both side acknowledging, the new key will become active for new transactions. The other key can typically be deleted within 12-24 hours after you are certain that no further transactions will occur on the old key. Given the variety of implementations, it is the customers responsibility to manage this key rotation.

Derived Keys - Derived keys such as DUKPT and EMV will change the key used upon every request based on changing counters and randomization data.

Stored Data - Crypto primitives such as AES CBC Encryption do not directly support key versioning because these formats do not include the requisite metadata to determine what key was originally used. When using low-level cryptography, you will need to manually rotate keys and track which keys were used alongside the actual data. The tags feature can be used to associate two keys as being the same type of key such as [{"Name":"Purpose","Value":"DataEncryption","Name":"Version","Value":"2"}]

If storing/retrieving data internally to your systems and there is a need/desire to use key versioning with automatic key rotation, we recommend evaluating KMS, which might meet your needs and is part of AWS' PCI DSS compliance listing.