<section>
 <h1 class="contains-headerlink leafygreen-ui-41fr9s" weight="medium">
  Rotate and Rewrap Encryption Keys
  <a class="headerlink leafygreen-ui-1kepx47" href="#rotate-and-rewrap-encryption-keys" title="Permalink to this heading">
   <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
    <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
    </path>
    <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
    </path>
   </svg>
   <div class="css-1btu0w3 evvkmar0" id="rotate-and-rewrap-encryption-keys">
   </div>
  </a>
 </h1>
 <div class="leafygreen-ui-a5yxub">
  <p class="css-1cmx2d4 ef7gu8j0">
   On this page
  </p>
  <ul class="css-1qb0mst ef7gu8j1">
   <li class="leafygreen-ui-1e7a0ei">
    <a class="lg-ui-0001 leafygreen-ui-e98ikf" href="#overview" target="_self">
     <span>
      Overview
     </span>
    </a>
   </li>
   <li class="leafygreen-ui-1jqtqlb">
    <a class="lg-ui-0001 leafygreen-ui-x9koo9" href="#related-information" target="_self">
     <span>
      Related Information
     </span>
    </a>
   </li>
   <li class="leafygreen-ui-1jqtqlb">
    <a class="lg-ui-0001 leafygreen-ui-cpmeq5" href="#procedure" target="_self">
     <span>
      Procedure
     </span>
    </a>
   </li>
   <li class="leafygreen-ui-1jqtqlb">
    <a class="lg-ui-0001 leafygreen-ui-x9koo9" href="#rotate-your-customer-master-key-on-your-key-management-system" target="_self">
     <span>
      Rotate your Customer Master Key on your Key Management System
     </span>
    </a>
   </li>
   <li class="leafygreen-ui-1jqtqlb">
    <a class="lg-ui-0001 leafygreen-ui-x9koo9" href="#rotate-your-data-encryption-keys-using-keyvault.rewrapmanydatakey--" target="_self">
     <span>
      Rotate your Data Encryption Keys using
      <code class="css-1kekw28 e1wawog0">
       KeyVault.rewrapManyDataKey()
      </code>
     </span>
    </a>
   </li>
  </ul>
 </div>
 <p class="leafygreen-ui-1kp3ins">
  In this guide, you can learn how to manage your encryption keys with a
Key Management System (
  <span class="leafygreen-ui-vm4wms" tabindex="0">
   KMS
  </span>
  ) in your application.
 </p>
 <section>
  <h2 class="contains-headerlink leafygreen-ui-19f71ei" weight="medium">
   Overview
   <a class="headerlink leafygreen-ui-1kepx47" href="#overview" title="Permalink to this heading">
    <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
     <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
     </path>
     <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
     </path>
    </svg>
    <div class="css-1btu0w3 evvkmar0" id="overview">
    </div>
   </a>
  </h2>
  <p class="leafygreen-ui-1kp3ins">
   This procedure shows you how to rotate encryption keys for Queryable Encryption using
   <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://www.mongodb.com/docs/mongodb-shell/#mongodb-binary-bin.mongosh" target="_self">
    <span>
     <code class="leafygreen-ui-1l06pbn">
      mongosh
     </code>
    </span>
   </a>
   . Rotating DEKs consists of rewrapping them with a
new Customer Master Key, so the terms "rotate" and "rewrap" are sometimes used interchangeably.
  </p>
  <p class="leafygreen-ui-1kp3ins">
   After completing this guide, you should be able to rotate your
Customer Master Key (
   <span class="leafygreen-ui-vm4wms" tabindex="0">
    CMK
   </span>
   ) on your Key Management System, and then rewrap
existing DEKs in your Key Vault collection with your new
   <span class="leafygreen-ui-vm4wms" tabindex="0">
    CMK
   </span>
   .
  </p>
  <div class="leafygreen-ui-1sjx7ru" role="note">
   <h2 class="leafygreen-ui-29m78u">
    Warning
   </h2>
   <div class="leafygreen-ui-9mycqc">
    <p class="leafygreen-ui-1kp3ins">
     As you rotate keys, confirm that they aren't used to encrypt any keys
or data before deleting them. If you delete a
     <span class="leafygreen-ui-vm4wms" tabindex="0">
      DEK
     </span>
     , all
fields encrypted with that
     <span class="leafygreen-ui-vm4wms" tabindex="0">
      DEK
     </span>
     become permanently
unreadable. If you delete a
     <span class="leafygreen-ui-vm4wms" tabindex="0">
      CMK
     </span>
     , all fields encrypted with a
     <span class="leafygreen-ui-vm4wms" tabindex="0">
      DEK
     </span>
     using that
     <span class="leafygreen-ui-vm4wms" tabindex="0">
      CMK
     </span>
     become permanently unreadable.
    </p>
   </div>
  </div>
  <section>
   <h3 class="contains-headerlink leafygreen-ui-15ajumo" weight="medium">
    Related Information
    <a class="headerlink leafygreen-ui-1kepx47" href="#related-information" title="Permalink to this heading">
     <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
      <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
      </path>
      <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
      </path>
     </svg>
     <div class="css-1btu0w3 evvkmar0" id="related-information">
     </div>
    </a>
   </h3>
   <p class="leafygreen-ui-1kp3ins">
    For a detailed explanation of the concepts included in this procedure,
refer to the topics below.
   </p>
   <p class="leafygreen-ui-1kp3ins">
    To learn more about keys and key vaults, see
    <a class="leafygreen-ui-tqgtui" href="/docs/manual/core/queryable-encryption/fundamentals/keys-key-vaults/#std-label-qe-reference-keys-key-vaults">
     Encryption Keys and Key Vaults
    </a>
    .
To view a list of supported
    <span class="leafygreen-ui-vm4wms" tabindex="0">
     KMS
    </span>
    providers, see the
    <a class="leafygreen-ui-tqgtui" href="/docs/manual/core/queryable-encryption/fundamentals/kms-providers/#std-label-qe-fundamentals-kms-providers">
     KMS Providers
    </a>
    page.
   </p>
   <p class="leafygreen-ui-1kp3ins">
    For tutorials detailing how to set up a Queryable Encryption enabled
application with each of the supported
    <span class="leafygreen-ui-vm4wms" tabindex="0">
     KMS
    </span>
    providers, see
    <a class="leafygreen-ui-tqgtui" href="/docs/manual/core/queryable-encryption/overview-enable-qe/#std-label-qe-overview-enable-qe">
     Overview: Enable Queryable Encryption
     <!-- -->
     .
    </a>
   </p>
  </section>
 </section>
 <section>
  <h2 class="contains-headerlink leafygreen-ui-19f71ei" weight="medium">
   Procedure
   <a class="headerlink leafygreen-ui-1kepx47" href="#procedure" title="Permalink to this heading">
    <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
     <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
     </path>
     <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
     </path>
    </svg>
    <div class="css-1btu0w3 evvkmar0" id="procedure">
    </div>
   </a>
  </h2>
  <script class="structured_data" type="application/ld+json">
   {"@context":"https://schema.org","@type":"HowTo","steps":[{"@type":"HowToStep","text":"The process for rotating your CMK (Customer Master Key) depends on your\nKMS (Key Management System) provider. For details, refer to your key provider's\ndocumentation:AWS: Rotating AWS KMS KeysAzure: Configure cryptographic key auto-rotation in Azure Key\nVaultGCP: Rotate a keyOnce you rotate the CMK (Customer Master Key), MongoDB uses it to wrap all new\nDEKs. To re-wrap existing DEKs, continue to the following steps.","name":"Rotate your Customer Master Key on your Key Management System"},{"@type":"HowToStep","text":"The KeyVault.rewrapManyDataKey() method automatically\ndecrypts multiple Data Encryption Keys and re-encrypts them using the\nspecified CMK (Customer Master Key). It then updates the keys in the\nKey Vault collection.The method has the following syntax:Specify a query filter document to select the keys to rotate, or omit the argument to rotate all keys in the Key Vault collectionIf you specify a query filter document, but no keys match, then no keys rotate.Specify the KMS (Key Management System) providerSpecify the masterKey using the new CMK (Customer Master Key),\nor omit the argument to rotate keys using their existing CMK (Customer Master Key)","name":"Rotate your Data Encryption Keys using KeyVault.rewrapManyDataKey()"}],"name":"Procedure","image":"https://webimages.mongodb.com/_com_assets/cms/kuyj2focmkbxv7gh3-stacked_default_slate_blue.svg?auto=format%252Ccompress"}
  </script>
  <div class="css-4nyere eccljxs0">
   <div class="css-1nuklj8 e1ckbxcu1">
    <div class="css-18fui5z e1ckbxcu0">
     <div class="css-19lsqsq e1ckbxcu2">
      1
     </div>
    </div>
    <div class="css-1ed38mk">
     <section>
      <h3 class="contains-headerlink leafygreen-ui-15ajumo" weight="medium">
       Rotate your Customer Master Key on your Key Management System
       <a class="headerlink leafygreen-ui-1kepx47" href="#rotate-your-customer-master-key-on-your-key-management-system" title="Permalink to this heading">
        <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
         <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
         </path>
         <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
         </path>
        </svg>
        <div class="css-1btu0w3 evvkmar0" id="rotate-your-customer-master-key-on-your-key-management-system">
        </div>
       </a>
      </h3>
      <p class="leafygreen-ui-1kp3ins">
       The process for rotating your
       <span class="leafygreen-ui-vm4wms" tabindex="0">
        CMK
       </span>
       depends on your
       <span class="leafygreen-ui-vm4wms" tabindex="0">
        KMS
       </span>
       provider. For details, refer to your key provider's
documentation:
      </p>
      <ul class="leafygreen-ui-rioki0">
       <li class="leafygreen-ui-d7p7b6">
        <p class="leafygreen-ui-1kp3ins">
         AWS:
         <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html" rel="noopener noreferrer">
          <span>
           Rotating AWS KMS Keys
          </span>
          <svg alt="" aria-hidden="true" class="leafygreen-ui-1ie5kuq" height="16" role="presentation" viewbox="0 0 16 16" width="16">
           <path d="M13.823 2.4491C13.8201 2.30008 13.6999 2.17994 13.5509 2.17704L9.5062 2.09836C9.25654 2.09351 9.12821 2.39519 9.30482 2.5718L10.3856 3.65257L7.93433 6.10383C7.87964 6.15852 7.83047 6.21665 7.78683 6.27752L5.99909 8.06525C5.46457 8.59977 5.46457 9.4664 5.99909 10.0009C6.53361 10.5354 7.40023 10.5354 7.93475 10.0009L9.72249 8.21317C9.78336 8.16953 9.84148 8.12037 9.89618 8.06567L12.3474 5.61441L13.4282 6.69518C13.6048 6.87179 13.9065 6.74347 13.9016 6.4938L13.823 2.4491Z" fill="currentColor">
           </path>
           <path d="M7.25 3.12893C7.66421 3.12893 8 3.46472 8 3.87893C8 4.29315 7.66421 4.62893 7.25 4.62893H4C3.72386 4.62893 3.5 4.85279 3.5 5.12893V11.9929C3.5 12.2691 3.72386 12.4929 4 12.4929H10.864C11.1401 12.4929 11.364 12.2691 11.364 11.9929V8.75C11.364 8.33579 11.6998 8 12.114 8C12.5282 8 12.864 8.33579 12.864 8.75V11.9929C12.864 13.0975 11.9686 13.9929 10.864 13.9929H4C2.89543 13.9929 2 13.0975 2 11.9929V5.12893C2 4.02436 2.89543 3.12893 4 3.12893H7.25Z" fill="currentColor">
           </path>
          </svg>
         </a>
        </p>
       </li>
       <li class="leafygreen-ui-d7p7b6">
        <p class="leafygreen-ui-1kp3ins">
         Azure:
         <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation" rel="noopener noreferrer">
          <span>
           Configure cryptographic key auto-rotation in Azure Key
Vault
          </span>
          <svg alt="" aria-hidden="true" class="leafygreen-ui-1ie5kuq" height="16" role="presentation" viewbox="0 0 16 16" width="16">
           <path d="M13.823 2.4491C13.8201 2.30008 13.6999 2.17994 13.5509 2.17704L9.5062 2.09836C9.25654 2.09351 9.12821 2.39519 9.30482 2.5718L10.3856 3.65257L7.93433 6.10383C7.87964 6.15852 7.83047 6.21665 7.78683 6.27752L5.99909 8.06525C5.46457 8.59977 5.46457 9.4664 5.99909 10.0009C6.53361 10.5354 7.40023 10.5354 7.93475 10.0009L9.72249 8.21317C9.78336 8.16953 9.84148 8.12037 9.89618 8.06567L12.3474 5.61441L13.4282 6.69518C13.6048 6.87179 13.9065 6.74347 13.9016 6.4938L13.823 2.4491Z" fill="currentColor">
           </path>
           <path d="M7.25 3.12893C7.66421 3.12893 8 3.46472 8 3.87893C8 4.29315 7.66421 4.62893 7.25 4.62893H4C3.72386 4.62893 3.5 4.85279 3.5 5.12893V11.9929C3.5 12.2691 3.72386 12.4929 4 12.4929H10.864C11.1401 12.4929 11.364 12.2691 11.364 11.9929V8.75C11.364 8.33579 11.6998 8 12.114 8C12.5282 8 12.864 8.33579 12.864 8.75V11.9929C12.864 13.0975 11.9686 13.9929 10.864 13.9929H4C2.89543 13.9929 2 13.0975 2 11.9929V5.12893C2 4.02436 2.89543 3.12893 4 3.12893H7.25Z" fill="currentColor">
           </path>
          </svg>
         </a>
        </p>
       </li>
       <li class="leafygreen-ui-d7p7b6">
        <p class="leafygreen-ui-1kp3ins">
         GCP:
         <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://cloud.google.com/kms/docs/rotate-key" rel="noopener noreferrer">
          <span>
           Rotate a key
          </span>
          <svg alt="" aria-hidden="true" class="leafygreen-ui-1ie5kuq" height="16" role="presentation" viewbox="0 0 16 16" width="16">
           <path d="M13.823 2.4491C13.8201 2.30008 13.6999 2.17994 13.5509 2.17704L9.5062 2.09836C9.25654 2.09351 9.12821 2.39519 9.30482 2.5718L10.3856 3.65257L7.93433 6.10383C7.87964 6.15852 7.83047 6.21665 7.78683 6.27752L5.99909 8.06525C5.46457 8.59977 5.46457 9.4664 5.99909 10.0009C6.53361 10.5354 7.40023 10.5354 7.93475 10.0009L9.72249 8.21317C9.78336 8.16953 9.84148 8.12037 9.89618 8.06567L12.3474 5.61441L13.4282 6.69518C13.6048 6.87179 13.9065 6.74347 13.9016 6.4938L13.823 2.4491Z" fill="currentColor">
           </path>
           <path d="M7.25 3.12893C7.66421 3.12893 8 3.46472 8 3.87893C8 4.29315 7.66421 4.62893 7.25 4.62893H4C3.72386 4.62893 3.5 4.85279 3.5 5.12893V11.9929C3.5 12.2691 3.72386 12.4929 4 12.4929H10.864C11.1401 12.4929 11.364 12.2691 11.364 11.9929V8.75C11.364 8.33579 11.6998 8 12.114 8C12.5282 8 12.864 8.33579 12.864 8.75V11.9929C12.864 13.0975 11.9686 13.9929 10.864 13.9929H4C2.89543 13.9929 2 13.0975 2 11.9929V5.12893C2 4.02436 2.89543 3.12893 4 3.12893H7.25Z" fill="currentColor">
           </path>
          </svg>
         </a>
        </p>
       </li>
      </ul>
      <p class="leafygreen-ui-1kp3ins">
       Once you rotate the
       <span class="leafygreen-ui-vm4wms" tabindex="0">
        CMK
       </span>
       , MongoDB uses it to wrap all new
DEKs. To re-wrap existing DEKs, continue to the following steps.
      </p>
     </section>
    </div>
   </div>
   <div class="css-1nuklj8 e1ckbxcu1">
    <div class="css-18fui5z e1ckbxcu0">
     <div class="css-19lsqsq e1ckbxcu2">
      2
     </div>
    </div>
    <div class="css-1ed38mk">
     <section>
      <h3 class="contains-headerlink leafygreen-ui-15ajumo" weight="medium">
       Rotate your Data Encryption Keys using
       <code class="leafygreen-ui-1l06pbn">
        KeyVault.rewrapManyDataKey()
       </code>
       <a class="headerlink leafygreen-ui-1kepx47" href="#rotate-your-data-encryption-keys-using-keyvault.rewrapmanydatakey--" title="Permalink to this heading">
        <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
         <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
         </path>
         <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
         </path>
        </svg>
        <div class="css-1btu0w3 evvkmar0" id="rotate-your-data-encryption-keys-using-keyvault.rewrapmanydatakey--">
        </div>
       </a>
      </h3>
      <p class="leafygreen-ui-1kp3ins">
       The
       <a class="leafygreen-ui-tqgtui" href="/docs/manual/reference/method/KeyVault.rewrapManyDataKey/#mongodb-method-KeyVault.rewrapManyDataKey">
        <code class="leafygreen-ui-1l06pbn">
         KeyVault.rewrapManyDataKey()
        </code>
       </a>
       method automatically
decrypts multiple Data Encryption Keys and re-encrypts them using the
specified
       <span class="leafygreen-ui-vm4wms" tabindex="0">
        CMK
       </span>
       . It then updates the keys in the
Key Vault collection.
      </p>
      <p class="leafygreen-ui-1kp3ins">
       The method has the following syntax:
      </p>
      <script class="structured_data" type="application/ld+json">
       {"@context":"https://schema.org","@type":"SoftwareSourceCode","codeSampleType":"code snippet","text":"let keyVault = db.getMongo().getKeyVault()\n\nkeyVault.rewrapManyDataKey(\n   {\n      \"&lt;query&gt;\"\n   },\n   {\n      provider: \"&lt;kms&gt;\",\n      masterKey: {\n         \"&lt;datakeyopts&gt;\" : \"&lt;datakeyopts&gt;\"\n      }\n   }\n)","programmingLanguage":"JavaScript"}
      </script>
      <div class="css-16lmvu9">
       <div class="leafygreen-ui-196mwvg">
        <div class="leafygreen-ui-yzcs8i">
         <pre class="leafygreen-ui-11itue3" tabindex="-1"><code class="lg-highlight-hljs-light javascript leafygreen-ui-9ybzas"><table class="leafygreen-ui-1tr4g10"><tbody><tr class=""><td class="leafygreen-ui-7razhx"><span class="lg-highlight-keyword">let</span> keyVault <!-- -->= <!-- -->db.<span class="lg-highlight-title lg-highlight-function">getMongo</span>(<!-- -->).<span class="lg-highlight-title lg-highlight-function">getKeyVault</span>(<!-- -->)</td></tr><tr class=""><td class="leafygreen-ui-7razhx"><div class="leafygreen-ui-ihxujy"></div></td></tr><tr class=""><td class="leafygreen-ui-7razhx">keyVault.<span class="lg-highlight-title lg-highlight-function">rewrapManyDataKey</span>(</td></tr><tr class=""><td class="leafygreen-ui-7razhx">   <!-- -->{</td></tr><tr class=""><td class="leafygreen-ui-7razhx">      <span class="lg-highlight-string">"&lt;Query filter document&gt;"</span></td></tr><tr class=""><td class="leafygreen-ui-7razhx">   }<!-- -->,</td></tr><tr class=""><td class="leafygreen-ui-7razhx">   <!-- -->{</td></tr><tr class=""><td class="leafygreen-ui-7razhx">      <span class="lg-highlight-attr">provider</span>: <span class="lg-highlight-string">"&lt;KMS provider&gt;"</span>,</td></tr><tr class=""><td class="leafygreen-ui-7razhx">      <span class="lg-highlight-attr">masterKey</span>: <!-- -->{</td></tr><tr class=""><td class="leafygreen-ui-7razhx">         <span class="lg-highlight-string">"&lt;dataKeyOpts Key&gt;"</span> <!-- -->: <span class="lg-highlight-string">"&lt;dataKeyOpts Value&gt;"</span></td></tr><tr class=""><td class="leafygreen-ui-7razhx">      }</td></tr><tr class=""><td class="leafygreen-ui-7razhx">   }</td></tr><tr class=""><td class="leafygreen-ui-7razhx">)</td></tr></tbody></table></code></pre>
         <div class="leafygreen-ui-1bqcprk" data-testid="leafygreen-code-panel">
          <button aria-disabled="false" aria-label="Copy" class="leafygreen-ui-1c6zwke" data-testid="code_copy-button" tabindex="0">
           <div class="leafygreen-ui-xhlipt">
            <svg aria-label="Copy Icon" class="leafygreen-ui-1st74h4" height="16" role="img" viewbox="0 0 16 16" width="16">
             <path clip-rule="evenodd" d="M1 5.71428V10.2857C1 11.2325 1.76751 12 2.71429 12H5.75V7.10957C5.75 6.54414 5.97724 6.00244 6.38065 5.60623L8.67403 3.35381C8.77447 3.25516 8.88376 3.16757 9 3.09182V2.71429C9 1.76751 8.23249 1 7.28571 1H5.8V4.42857C5.8 5.13865 5.22437 5.71428 4.51429 5.71428H1ZM9 4.78571L7.25654 6.49804C7.24689 6.50752 7.23749 6.5172 7.22834 6.52708C7.22208 6.53383 7.21594 6.54068 7.20991 6.54762C7.07504 6.70295 7 6.90234 7 7.10957V7.79762H9H10.0095C10.4829 7.79762 10.8667 7.41386 10.8667 6.94047V4H10.1505C9.92587 4 9.7102 4.0882 9.54992 4.24562L9 4.78571ZM4.86667 1H4.15053C3.92587 1 3.7102 1.0882 3.54992 1.24562L1.25654 3.49804C1.09244 3.65921 1 3.87957 1 4.10957V4.79762H4.00952C4.48291 4.79762 4.86667 4.41386 4.86667 3.94047V1ZM7 12V8.71428H9H10.5143C11.2244 8.71428 11.8 8.13865 11.8 7.42857V4H13.2857C14.2325 4 15 4.76751 15 5.71429V13.2857C15 14.2325 14.2325 15 13.2857 15H8.71429C7.76751 15 7 14.2325 7 13.2857V12Z" fill="currentColor" fill-rule="evenodd">
             </path>
            </svg>
           </div>
          </button>
         </div>
        </div>
       </div>
      </div>
      <ol class="leafygreen-ui-rioki0" type="1">
       <li class="leafygreen-ui-d7p7b6">
        <p class="leafygreen-ui-1kp3ins">
         Specify a query filter document to select the keys to rotate, or omit the argument to rotate all keys in the Key Vault collection
        </p>
        <p class="leafygreen-ui-1kp3ins">
         If you specify a
         <a class="leafygreen-ui-tqgtui" href="/docs/manual/core/document/#std-label-document-query-filter">
          query filter document
         </a>
         , but no keys match, then no keys rotate.
        </p>
       </li>
       <li class="leafygreen-ui-d7p7b6">
        <p class="leafygreen-ui-1kp3ins">
         Specify the
         <span class="leafygreen-ui-vm4wms" tabindex="0">
          KMS
         </span>
         provider
        </p>
       </li>
       <li class="leafygreen-ui-d7p7b6">
        <p class="leafygreen-ui-1kp3ins">
         Specify the
         <code class="leafygreen-ui-1l06pbn">
          masterKey
         </code>
         using the new
         <span class="leafygreen-ui-vm4wms" tabindex="0">
          CMK
         </span>
         ,
or omit the argument to rotate keys using their existing
         <span class="leafygreen-ui-vm4wms" tabindex="0">
          CMK
         </span>
        </p>
       </li>
      </ol>
     </section>
    </div>
   </div>
  </div>
  <p class="leafygreen-ui-1kp3ins">
   Your DEKs themselves are left unchanged after re-wrapping them
with the new
   <span class="leafygreen-ui-vm4wms" tabindex="0">
    CMK
   </span>
   . The key rotation process is seamless, and does
not interrupt your application.
  </p>
 </section>
</section>
