# Ensure KMS keys with key rotation is not disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000127090-ensure-kms-keys-with-key-rotation-is-not-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-06-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS. It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled. 

  

Rationale:

Rotating encryption keys help reduce the potential impact of a compromised key as data encrypted with a new key cannot be accessed with a previous key that may have been exposed. 

  

Impact:

The automatic key rotation does not affect the data that the CMK protects. It does not rotate the data keys that the CMK generated or re-encrypt any data protected by the CMK, and it will not mitigate the effect of a compromised data key.

  

Default Value:

In Aws, key rotation is not enabled by default.

  

Pre-Requisite:

1.  Sign in as an admin or IAM user with the required permissions
    
2.  There must be at least one key
    

  

Remediation:

Test Plan:

1.  Sign in to AWS console
    
2.  Navigate to KMS service at [https://console.aws.amazon.com/kms/](https://console.aws.amazon.com/kms/)
    
3.  Click on the Customer managed Keys in the left navigation pane
    
4.  Click on any key that you want to examine and select the key rotation tab and check whether the key 
    

rotation is enabled or not  

5.  If you notice that the rotation is not enabled follow the Implementation steps
    

  

Implementation Steps:

1.  Sign in to the AWS Management Console
    
2.  Navigate to KMS service at [https://console.aws.amazon.com/kms/](https://console.aws.amazon.com/kms/) 
    
3.  Click on the Customer managed Keys in the left navigation pane  
      
    Note: In Customer managed keys we can have different Keys make sure to select the correct key for enabling the automatic rotation.
    
4.  Select the key you want to remediate
    
5.  select the key rotation tab  
    
6.  Now check the Key rotation checkbox for enabling Key rotation and Click on Save  
    

  

Using AWS CLI:

 aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Backout Plan:

1.  Sign in to the AWS Management Console
    
2.  Navigate to KMS service at [https://console.aws.amazon.com/kms/](https://console.aws.amazon.com/kms/) 
    
3.  Click on the Customer managed Keys in the left navigation pane
    
4.  Click on the key you want to disable the rotation
    
5.  Now uncheck the Key rotation check box For disabling (Automatically rotate this CMK every year) and Click on Save
    

  

Using AWS CLI:

aws kms disable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Reference:

-   [https://aws.amazon.com/kms/](https://aws.amazon.com/kms/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.