For a CMK with key material generated by the service, if you opt-in to have it automatically rotate the key each year, each new key version raises the cost of the CMK by $1/month. AWS KMS retains and manages each previous version of the CMK to ensure you can decrypt data encrypted under previous versions. Data key pairs, which are created by GenerateDataKeyPair and