Migrating ciphertext between Vault Transit key versions without re-encryption
Vault Transit's rewrap endpoint lets you migrate existing ciphertext to a new key version without decrypting and re-encrypting your data. Here's how it works, with a concrete example and trade-offs.
vault