code: ContentCryptoMaterial recreate(EncryptionMaterials newKEK,
                                     EncryptionMaterialsAccessor accessor, S3CryptoScheme targetScheme,
                                     CryptoConfiguration config, AWSKMS kms, AmazonWebServiceRequest req) {
          if (!usesKMSKey()
              &&  newKEK.getMaterialsDescription().equals(kekMaterialsDescription)) {
              throw new SecurityException(
                  "Material description of the new KEK must differ from the current one");
          }
          final EncryptionMaterials origKEK;
          if (usesKMSKey()) {
              origKEK = new KMSEncryptionMaterials(kekMaterialsDescription.get(
                  KMSEncryptionMaterials.CUSTOMER_MASTER_KEY_ID));
          } else {
              origKEK = accessor.getEncryptionMaterials(kekMaterialsDescription);
          }
          SecretKey cek = cek(encryptedCEK, keyWrappingAlgorithm, origKEK, config.getCryptoProvider(),
                              getContentCryptoScheme(), kms);
          ContentCryptoMaterial output =
              create(cek, cipherLite.getIV(), newKEK,
                     getContentCryptoScheme(),  // must use same content crypto scheme
                     targetScheme, // target scheme used to recreate the content crypto material
                     config, kms, req);
          if (Arrays.equals(output.encryptedCEK, encryptedCEK)) {
              throw new SecurityException(
                  "The new KEK must differ from the original");
          }
          return output;
      }
docs: Recreates a new content crypto material from the current material given a
  new KEK encryption materials. The purpose is to re-encrypt the CEK under
  the new KEK.
  
  Note network calls are involved if the CEK has been or is to be protected
  by KMS.
  
  @param newKEK
  encryption materials for the new KEK; must not be null
  @param accessor
  used to retrieve the original KEK given the corresponding
  material description
  @param targetScheme
  the target crypto scheme to use for recreating the content
  crypto material
  @throws SecurityException
  if the old and new material description are the same; or if
  the old and new KEK are the same