New objects are encrypted with a new customer managed key. The old key was disabled before existing objects were re-encrypted, and reads of those older objects fail. Each old object still names the old key. What restores the reads?
Select an answer to reveal the explanation.
Short Explanation
You changed the lock and then disabled the old key while the old boxes still name that key. A disabled key cannot decrypt, so re-enable it until those objects are re-encrypted under the new key. Reading them with the new key id fails because that key did not create the ciphertext.
Full Explanation
SSE-KMS stores the key that encrypted the object. A different key id cannot decrypt that ciphertext, and a disabled key cannot be used for decrypt at all. Enable the old key so existing objects can be read, copy them so they are encrypted with the new key, and disable the old key only after those reads no longer need it. Leaving the old key disabled and naming the new key id in the application does not rewrap the ciphertext. Automatic rotation is a feature of a single key: previous material under that same key can still decrypt. It does not make a second key read ciphertext from the key you disabled. Deleting the old key makes the old objects permanently unreadable. Caveat: while the old key is enabled, new writes should keep using the new key so you do not create more objects you will have to move. Operational check: an old object should read successfully after the old key is enabled, a rewritten object should show the new key in its encryption metadata, and only then should the old key be disabled.