# 3.6 Ensure rotation for customer-created symmetric CMKs is enabled (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234249-3-6-ensure-rotation-for-customer-created-symmetric-cmks-is-enabled-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: Customer Managed Keys (CMKs) are encryption keys created and managed by customers in AWS Key Management Service (KMS). For enhanced security, it is essential to enable automatic rotation for symmetric CMKs. Key rotation ensures that encryption keys are periodically updated, reducing the risk of key compromise and minimizing the impact of potential breaches. Enabling key rotation for CMKs helps ensure compliance with best practices and security regulations, and it automatically manages key lifecycle events, reducing the administrative burden on security teams. #### Rationale: Symmetric CMKs are used to encrypt and decrypt data. If a CMK is compromised, it is essential to ensure that it is periodically rotated to limit the risk of misuse. Key rotation: - Reduces the risk of key compromise by automatically generating a new key and using it for encryption and decryption. - Ensures that encryption keys are updated regularly, minimizing the chances of an attacker accessing old keys. - Helps maintain compliance with regulatory requirements (e.g., PCI-DSS, HIPAA) that mandate the rotation of cryptographic keys. Without enabling automatic key rotation, CMKs would need to be manually rotated, which is error-prone and increases the risk of mismanagement. #### Impact: Failure to enable automatic rotation for symmetric CMKs can result in: - Increased risk of key compromise. - Failure to comply with industry regulations that require key rotation. - Lack of automated key management, leading to human error in manual rotation processes. Enabling automatic key rotation ensures that keys are rotated at a set interval, which strengthens the security of encrypted data and reduces the manual overhead of key management. #### Default Value: By default, key rotation for CMKs is disabled. You must explicitly enable key rotation for each symmetric CMK to ensure regular key rotation. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - kms:DescribeKey - kms:PutKeyPolicy - kms:EnableKeyRotation - CMKs must be symmetric, as asymmetric keys do not support automatic rotation #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [KMS Console](https://console.aws.amazon.com/kms/). 2. Verify that Key rotation is enabled for each customer-managed symmetric CMK. 3. Go to the [AWS Config Console](https://console.aws.amazon.com/config/) and verify that the Configuration Recorder is enabled to track CMK configurations. Using AWS CLI: aws kms get-key-rotation-status --key-id --query "KeyRotationEnabled" --output table To verify if AWS Config is tracking CMK rotation configurations: aws configservice describe-configuration-recorders --query "ConfigurationRecorders\[?recordingGroup.allSupported==\`true\`\].{Name:name, RecordingGroup:recordingGroup}" --output table ##### Implementation Plan: Using AWS Console: 1. Enable automatic key rotation for symmetric CMKs: - Go to the [KMS Console](https://console.aws.amazon.com/kms/). - Select the symmetric CMK for which you want to enable rotation. - In the Key actions section, click Enable rotation for the selected key. 2. Enable AWS Config to monitor CMK rotation: - In the [AWS Config Console](https://console.aws.amazon.com/config/), ensure the Configuration Recorder is active and tracking CMK configurations. Using AWS CLI: 1. Enable key rotation for a symmetric CMK: aws kms enable-key-rotation --key-id 2. Enable AWS Config to monitor CMK rotation: aws configservice record-configuration-changes --configuration-recorder-name --include-configuration-item-types "AWS::KMS::Key" #### Backout Plan: Using AWS Console: 1. If automatic key rotation causes issues with existing encryption or compliance: - Go to the [KMS Console](https://console.aws.amazon.com/kms/). - Disable key rotation for the CMK by selecting Disable rotation under the Key actions menu. 2. Modify AWS Config settings to exclude CMKs from being monitored if there are performance or resource consumption issues. Using AWS CLI: 1. Temporarily disable key rotation: aws kms disable-key-rotation --key-id 2. Stop recording CMK rotation configurations in AWS Config: aws configservice stop-configuration-recorder --configuration-recorder-name 3. Re-enable monitoring once issues are resolved: aws kms enable-key-rotation --key-id aws configservice start-configuration-recorder --configuration-recorder-name #### References: - [AWS KMS Documentation ](https://docs.aws.amazon.com/kms/latest/developerguide/rotation-for-symmetric.html) - [AWS CloudTrail Documentation ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - [AWS Config Documentation ](https://docs.aws.amazon.com/config/latest/developerguide/) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.