aws kms create-key \
  --description "prod/customer-data-kek" \
  --key-usage ENCRYPT_DECRYPT \
  --customer-master-key-spec SYMMETRIC_DEFAULT

aws kms create-alias \
  --alias-name alias/prod-customer-data-kek \
  --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab

aws kms enable-key-rotation \
  --key-id alias/prod-customer-data-kek \
  --rotation-period-in-days 180

aws kms generate-data-key \
  --key-id alias/prod-customer-data-kek \
  --key-spec AES_256