ReEncrypt re-wraps the data key under the current CMK version (value
ciphertext unchanged — cheap). ?regenerate_dek=true does a full DEK rotation +
value re-encryption.Vault
Rotate Vault Entry
POST /v1/users/:user_id/vault/:key/rotate — re-wrap the DEK.