https://cambelo.com/posts/demystifying-aws-kms-key-rotation/