A Developer is storing sensitive documents in Amazon S3 that will require encryption at rest. The encryption keys must be rotated annually, at least. What is the easiest way to achieve this?

Questions on how to write code and design scalable applications, implement application security and testing, and on AWS components such as S3, Dynamo DB, Elastic Beanstalk, and CloudFormation.