}

    /**
     * Set the key rotation bytes limit
     *
     * @param limit number of bytes to encrypt before rotating keys
     */
    public void setKeyRotationBytesLimit(long limit) {
        this.keyRotationBytesLimit = limit;
    }

    /**
     * Set the key rotation time limit
     *
     * @param limit time in milliseconds before rotating keys
     */

        assertNotNull(encrypted2);

        // Verify rotation occurred by checking metrics
        assertTrue(context.getKeyRotationCount() > 0, "Key rotation should have occurred");

        // Can still encrypt after rotation
        byte[] plaintext3 = "Message after rotation".getBytes();
        byte[] encrypted3 = assertDoesNotThrow(() -> context.encryptMessage(plaintext3, 3L));

                Thread t = new Thread(r, "SecureKeyManager-Rotation");
                t.setDaemon(true);
                return t;
            });
    private java.util.concurrent.ScheduledFuture<?> rotationTask;

    /**
     * Configure key rotation interval
     *
     * @param intervalMillis rotation interval in milliseconds
     */
    public void configureKeyRotation(long intervalMillis) {

	// When FileNameFunc is not specified, DefaultFilenameFunc will be used.
	FileNameFunc func() string

	// Compress specify if you want the logs to be compressed after rotation.
	Compress bool
}

// Writer is a concurrency-safe writer with file rotation.
type Writer struct {
	// opts are the configuration options for this Writer
	opts Options

	// f is the currently open file used for appends.

                    | object_metadata_1 |               | object_metadata_2 |
                    +-------------------+               +-------------------+
```

#### Key rotation - Basic Operation

//go:generate msgp -file $GOFILE -unexported

// BatchKeyRotationType defines key rotation type
type BatchKeyRotationType string

const (
	sses3  BatchKeyRotationType = "sse-s3"
	ssekms BatchKeyRotationType = "sse-kms"
)

// BatchJobKeyRotateEncryption defines key rotation encryption options passed
type BatchJobKeyRotateEncryption struct {
	Type       BatchKeyRotationType `yaml:"type" json:"type"`

func (opts Config) ReplicationWait() time.Duration {
	configMu.RLock()
	defer configMu.RUnlock()

	return opts.ReplicationWorkersWait
}

// KeyRotationWait returns the duration for which a batch key-rotation worker
// would wait before working on next object.
func (opts Config) KeyRotationWait() time.Duration {
	configMu.RLock()
	defer configMu.RUnlock()

	return opts.KeyRotationWorkersWait
}

    }

    @Test
    public void testMultipleKeyRotations() throws GeneralSecurityException {
        String sessionId = "multi-rotation";
        keyManager.storeSessionKey(sessionId, testKey, "AES");

        // Perform multiple rotations
        for (int i = 1; i <= 5; i++) {
            int version = keyManager.rotateSessionKey(sessionId);
            assertEquals(i, version, "Version should be " + i);

   change the cluster root credentials since they were used to en/decrypt the IAM data.
   So, both - the old and new credentials - had to be present at the same time during a rotation
   and the old credentials had to be removed once the rotation completed. This process is now gone.
   The root credentials can now be changed easily.

> Does this mean I need an enterprise KMS setup to run MinIO (securely)?

(1turn);transform:rotate(1turn)}}.fa-rotate-90{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";-webkit-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-ms-filter:"progid:DX...