{"id":"kms-only-primary-version-encrypts","text":"For symmetric encryption keys, only the primary version can encrypt data; any enabled version can decrypt, but non-primary enabled versions cannot encrypt.","truth_value":"IN","source":"entries/2026/03/11/kms-key-versions.md","source_url":"","source_hash":"837eb3046c40f6f2","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"kms-only-primary-version-encrypts","truth_value":"IN","reason":"premise"}]}}