disable key rotation for the symmetric key used for S3 bucket encryption, this is to avoid the CA failing after 1 year when it would then be unable to decrypt older S3 objects
update module naming for SNS, this will cause deletion and recreation of the SNS topic, so any subscriptions will have to be set up again