Control: 3.8 Ensure rotation for customer created CMKs is enabled
AWS KMS enables customers to rotate the backing key, which is key material stored in AWS KMS and is tied to the key ID of the CMK. It's the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all previous backing keys so that decryption of encrypted data can take place transparently.
Rotating encryption keys helps reduce the potential impact of a compromised key as data encrypted with a new key cannot be accessed with a previous key that may have been exposed.
Perform the following to configure key rotation:
- Open the AWS KMS console at KMS.
- In the left navigation pane, choose
Customer managed keys.
- Choose the alias of the key to
updatein the Alias column.
- Under the Key rotation section, move down to Key Rotation .
Automatically rotate this CMK every yearand then choose Save.
From Command Line
- Run the following command to get a list of all keys and their associated KeyIds
aws kms list-keys
- For each key, note the KeyId and run the following command
aws kms get-key-rotation-status --key-id <kms_key_id>
- Ensure KeyRotationEnabled is set to true
steampipe check aws_compliance.control.cis_v140_3_8
This control uses a named query:kms_cmk_rotation_enabled