Description

Ensure every customer-managed master encryption key in OCI Vault is rotated at least every 365 days. In virtual private vaults, this should be done with automatic key rotation set to an interval of 365 days or less. In default vaults, which do not support automatic rotation, keys must be rotated manually on a schedule.

Rationale

The longer a key version is used, the more data it protects, and the greater the impact if it is ever exposed. Rotating keys regularly limits the amount of data encrypted under any single key version and supports compliance requirements. After rotation, new data uses the new key version while existing data can still be decrypted.

Impact

  • Limits how much data is protected by one key version

  • Supports compliance requirements for key rotation

  • Automatic rotation is available only in virtual private vaults

Default Value

By default, customer-managed keys are not rotated. Automatic key rotation is available only for keys in virtual private vaults, with an interval between 60 and 365 days (default 90).

Pre-Requisites

  • Permission to manage keys in the vault's compartment

  • Knowledge of whether each key is in a default vault or a virtual private vault

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and select Vault (Key Management & Secret Management). Choose the compartment and select the vault.

  3. Open Master encryption keys and select each key.

  4. For keys in a virtual private vault, verify that auto rotation is enabled and the rotation interval is 365 days or less.

  5. For keys in a default vault, check the date of the current key version and confirm it is less than 365 days old.

  6. If a key is not rotated within 365 days, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and select Vault. Select the vault and open Master encryption keys.

  3. For a key in a virtual private vault, select the key, open Actions, and select Edit auto-rotation settings. Select Auto rotation, set a start date and a rotation interval of 365 days or less, and save.

  4. For a key in a default vault, select the key and select Rotate key, then confirm. Set a calendar reminder or automation to repeat this at least every 365 days.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the vault, select the key, open Actions, and select Edit auto-rotation settings.

  3. Clear the Auto rotation checkbox, or restore the previous interval, and save. Rotated key versions remain available to decrypt existing data.

Reference