You are using Vault ' s Transit secrets engine to encrypt your data.

The Transit secrets engine supports the rotation of encryption keys, which allows you to change the key that is used to encrypt new data without affecting the ability to decrypt data that was already encrypted. This reduces the amount of content encrypted with a single key in case the key gets compromised, and also helps you comply with the NIST guidelines for key rotation. You can rotate the encryption key manually by invoking the /transit/keys/ < name > /rotate endpoint, or you can configure the key to automatically rotate based on a time interval or a number of encryption operations. When you rotate a key, Vault generates a new key version and increments the key’s latest_version metadata. The new key version becomes the encryption key used for encrypting any new data. The previous key versions are still available for decrypting the existing data, unless you specify a minimum decryption version to archive the old key versions.  You can also delete or disable old key versions if you want to revoke access to the data encrypted with those versions.  References: https://developer.hashicorp.com/vault/docs/secrets/transit 1 , https://developer.hashicorp.com/vault/api-docs/secret/transit 2