Is AWS KMS automatic key rotation compatible with SOPS?

Hello, I have been searching around the internet for an answer to my question, but have not found a clear answer. So I would like to pose it here, and also ask for an update to your documentation/readme with the answer.

My question is: Can SOPS be used with AWS KMS keys that have automatic rotation turned on? (See AWS docs)

This is the scenario I am concerned about: after the cryptographic material rotates on the AWS side, any files encrypted with SOPS prior to the rotation had different private material, and therefore the decryption will not produce the same results. Despite what AWS says in its documentation about keeping all previous crypto materials on their side, the documentation subtly implies that it works only with other AWS products. My reasoning here (which may be incorrect) is, that the AWS API likely only uses the current crypto material with external callers of the API. Something I am not clear on, is that the CLI spec for kms decrypt indicates that the ciphertext contains some data that specifies the key id used, but it does not mention if the version of cryptographic material is encoded into it also.

Motivating this question is the fact that my team is using AWS SecurityHub and implementing the guidelines. One of which is that every custom KMS key needs to have automatic rotation turned on. While we could manually rotate keys (either via SOPS -r option, or through the AWS console), the point is for us to be compliant according to the SecurityHub rules. For reference: CIS.2.8 and PCI.KMS.1, and CMK backing key rotation rule in AWS Config.

Thanks, and do let me know if I may clarify anything.

Start by reviewing the linked AWS KMS rotation and decrypt documentation alongside the SOPS documentation or README. Determine whether SOPS can decrypt data after automatic KMS key rotation, then document the answer and any relevant usage guidance in the appropriate documentation location.