Skip to content

ReEncrypt

Source: src/AWS/KMS/ReEncrypt.ts

Runtime binding for kms:ReEncrypt.

Re-encrypts a ciphertext under a new key (or a new encryption context) entirely inside KMS — the plaintext never leaves the service. Bind the destination KMS Key (or alias/... name), and optionally the source key when migrating ciphertexts between keys:

  • ReEncrypt(key) — same-key re-encryption (e.g. rotating the encryption context). Grants kms:ReEncryptFrom + kms:ReEncryptTo on the key.
  • ReEncrypt(destination, source) — cross-key migration. Grants kms:ReEncryptTo on the destination and kms:ReEncryptFrom on the source, and pins SourceKeyId in every request.

Re-Encryption

Section titled “Re-Encryption”

Rotate the Encryption Context In Place

const reEncrypt = yield* AWS.KMS.ReEncrypt(key);


const { CiphertextBlob } = yield* reEncrypt({
  CiphertextBlob: ciphertext,
  SourceEncryptionContext: { tenant: "alpha" },
  DestinationEncryptionContext: { tenant: "beta" },
});

Migrate Ciphertexts to a New Key

const reEncrypt = yield* AWS.KMS.ReEncrypt(newKey, oldKey);


const { CiphertextBlob } = yield* reEncrypt({
  CiphertextBlob: legacyCiphertext,
});