Automatic rotation is enabled for an eligible symmetric KMS key. What happens to data encrypted under previous key material?

1. Every S3 object is automatically rewritten to a new storage class.
2. KMS retains prior key material to decrypt existing ciphertext; rotation does not re-encrypt every object.
3. All existing ciphertext becomes unreadable immediately.
4. The key ARN changes on every automatic rotation.