KMS API Calls Exam Tips aws kms encrypt encrypts data aws kms decrypt decrypts data aws kms re-encrypt decrypts then re-encrypts straight away aws kms enable-key-rotation rotate keys once per year