I am testing the code for the AWS key rotation for CSFLE and getting the credential from On-Premises. 

Based on this document I am following these steps:

• Getting the credentials 

• Adding the credentials to kmsProviderPropertySuppliers

• Building the autoEncryptionSettings with the kmsProviderPropertySuppliers

• Add the autoEncryptionSettings  to the mongoClientSettings

• Create a mongoClient using mongoClientSettings

• Run the query

• GETTING NEW credentials 

• Adding the credentials to kmsProviderPropertySuppliers

• Building the autoEncryptionSettings with the kmsProviderPropertySuppliers

• Add the autoEncryptionSettings  to the mongoClientSettings

• Run the query using the NEW credentials

 My understanding is that I should not create a new client when a new set of AccessKey and SecurityKey is generated. But without creating a new client the new keys are not picked up.

Find attached my code.