Keys: KMS handles rotation of the master key automatically (http://docs.aws.amazon.com/kms/latest/developerguide/rotate-...). The ephemeral key used to encrypt values is changed any time a value is set.

Values: https://github.com/dcoker/biscuit#how-do-i-rotate-the-values