Platform & DevOps·Secrets, identity and the supply chain
the data is encrypted with a key that is itself encrypted by a key you never see, and rotating the outer one does not rewrite the data.
Envelope encryption
Also calledkey wrapping, data key encryption
Encrypting data with a locally-generated data key, then encrypting that key with a master key held in a key management service. It keeps bulk encryption fast and local while centralising control, and it makes master key rotation cheap because only the small wrapped keys need re-encrypting. It is the standard construction under nearly every managed at-rest encryption feature, which is worth knowing because the master key's access policy is then the real control.