# 3.6 Ensure Rotation for Customer-Created Symmetric CMKs Is Enabled (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233160-3-6-ensure-rotation-for-customer-created-symmetric-cmks-is-enabled-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 3](https://support.icompaas.com/support/solutions/folders/62000169197) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Profile Applicability:** **Level 2** ## **Description:** AWS Key Management Service (KMS) allows customers to automate key rotation for customer-managed keys (CMKs). Key rotation creates new key material while retaining old keys for seamless decryption of previously encrypted data.By enabling key rotation, AWS automatically rotates the encryption key every year, reducing the risk of key compromise. ## Rationale: - Key rotation enhances security by limiting the exposure of compromised keys. Protects encrypted data by ensuring only the most recent key is used for encryption. - Supports compliance requirements such as NIST, PCI DSS, SOC 2, ISO 27001, HIPAA, and CIS benchmarks. - Without key rotation, if a key is compromised, all past and future encrypted data is vulnerable. ## Impact: - Ensures secure and continuous encryption without manual intervention. - Reduces risk of data compromise from old keys. - Does not break existing data decryption (previous keys remain available). ## Default Value By default, KMS key rotation is NOT enabled for customer-managed CMKs. KMS rotates AWS-managed keys automatically, but not customer-created CMKs. ## Pre-Requisites IAM permissions required: - kms:ListKeys - kms:DescribeKey - kms:GetKeyRotationStatus - kms:EnableKeyRotation AWS CLI installed for automation. ## Remediation: ### Test Plan: ## Using AWS Console Step 1: Check If Key Rotation Is Enabled for Customer-Managed CMKs 1. Log in to the AWS Management Console 2. Navigate to KMS Console → [AWS KMS](https://console.aws.amazon.com/kms)    ![](https://support.icompaas.com/assets/kb/abdabc8a3b4c466e.png) 3. Click Customer-managed keys in the left navigation pane        ![](https://support.icompaas.com/assets/kb/47e021a2932b2a86.png) 4. Select a CMK with Key spec = SYMMETRIC\_DEFAULT       ![](https://support.icompaas.com/assets/kb/1044d83a59cad637.png) 5. Click the Key rotation tab       ![](https://support.icompaas.com/assets/kb/2ca9ef7312407ddf.png) 6. Ensure "Automatically rotate this KMS key every year" is  checked        ![](https://support.icompaas.com/assets/kb/69a8d0b0903d02f2.png) 7. Repeat for all customer-managed CMKs -  If rotation is enabled, no further action is needed. - If rotation is disabled, follow remediation steps. ## Using AWS CLI Step 1: List All CMKs aws kms list-keys --query 'Keys\[\*\].KeyId' Step 2: Check Key Rotation Status aws kms get-key-rotation-status --key-id ## Implementation steps: ## Using AWS Console Step 1: Enable Key Rotation for CMKs 1. Log in to the AWS Management Console 2. Navigate to KMS Console → [AWS KMS](https://console.aws.amazon.com/kms)    ![](https://support.icompaas.com/assets/kb/cf37f5bb202632a8.png) 3. Click Customer-managed keys       ![](https://support.icompaas.com/assets/kb/2fbd47fbbac1d2ff.png) 4. Select a CMK with Key spec = SYMMETRIC\_DEFAULT   ![](https://support.icompaas.com/assets/kb/d3ce43a4612b545c.png) 5. Click the Key rotation tab     ![](https://support.icompaas.com/assets/kb/37aec12813fe29e7.png) 6. Check the box "Automatically rotate this KMS key every year"      ![](https://support.icompaas.com/assets/kb/e280d50bf23bec2e.png) 7. Click Save      ![](https://support.icompaas.com/assets/kb/5ae1e58570fd4ef2.png) -  Repeat for all CMKs ## Using AWS CLI Step 1: Enable Key Rotation for a Specific CMK aws kms enable-key-rotation --key-id Repeat for all customer-managed CMKs. Step 2: Verify Key Rotation Status aws kms get-key-rotation-status --key-id Backout Plan: - If enabling KMS key rotation causes issues: Disable Key Rotation via AWS CLI aws kms disable-key-rotation --key-id - Verify Key Rotation is Disabled aws kms get-key-rotation-status --key-id - If the output is false, rotation is disabled. - Ensure disabling key rotation is justified before proceeding. ## ## References: - AWS KMS Key Rotation Guide: [AWS Docs](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) - AWS CLI Reference (Key Rotation): [AWS CLI Docs](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/enable-key-rotation.html) - NIST Guidelines on Key Management: [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) ## CIS Controls Mapping: | CIS Control Version | Control ID | Control Description | | --- | --- | --- | | CIS v8 | 3.11 | Encrypt sensitive data at rest using encryption mechanisms like KMS key rotation. | | --- | --- | --- | | CIS v8 | 14.8 | Ensure encryption policies are enforced for critical data storage. | | --- | --- | --- | | CIS v7 | 16.1 | Implement data encryption standards that meet industry best practices. | | --- | --- | --- | | CIS v7 | 6.3 | Enable detailed security logging to track encryption key activities. | ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.