---
title: "tenant rotate-encryption-group-key"
slug: "tenant-rotate-encryption-group-key"
updated: 2026-10-27T17:24:38Z
published: 2026-10-27T17:24:38Z
canonical: "docs.vastdata.com/tenant-rotate-encryption-group-key"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tenant rotate-encryption-group-key

If encryption is enabled with encryption type *CIPHER_TRUST_KMIP* (where encryption keys are managed externally on Thales Group CipherTrust Data Security Platform), this command rotates the key encryption key for the encryption group to which a given tenant belongs. The key encryption key is used by the cluster to retrieve the data encryption key from the EKM when needed to encrypt data. Rotating the key encryption key generates a new version of the key encryption key, with the same key name and attributes.

## Usage

```plaintext
tenant rotate-encryption-group-key --id ID
```

## Required Parameters

| `--id ID` | Specifies a tenant. |
| --- | --- |

## Example

```plaintext
vcli: admin> tenant rotate-encryption-group-key --id 5
Tenants using this encryption group: tenant_1.
Are you sure you want to rotate tenant's encryption group key? [y/N] y
Tenant's encryption group key was rotated successfully.
```