All checks
Medium
AWS KMS key rotation should be enabled
Checks that automatic key rotation is enabled on each customer managed symmetric encryption KMS key. Rotation gives the key new key material, yearly by default, while it keeps its ID and decrypts older data, so data encrypted later is safe from material that may have been exposed. A key pending deletion fails, as KMS reports its rotation as off; keys that cannot rotate automatically pass.
- service
- KMS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
Key Management Service → Customer managed keys → the key → Key rotation → Automatic key rotation → Edit
- Key rotation
- Enable; a disabled key must be enabled first, and a multi-Region replica takes it from its primary key
- Rotation period
- Optional, 90 to 2560 days; 365 when left empty
With the AWS CLI
aws kms enable-key-rotation --key-id <key-id> --region <region>With Terraform
resource "aws_kms_key" "this" {
enable_key_rotation = true
rotation_period_in_days = 365
}See which of your accounts this check is failing on.
Book a live scan