yep, I'm aware of manual key rotation, but I'd like to explicitly avoid it because:

• it requires we take down our clusters (not feasible for our reporting clusters)
• it means we have to add extra infra to our terraform to execute the rotation (feels needless if AWS can already rotate them automatically)