Description

Ensure that automatic key rotation is enabled for every customer managed AWS KMS key that is enabled and of the symmetric encryption type (SYMMETRIC_DEFAULT). With automatic rotation, AWS KMS creates new key material on a regular schedule while keeping the same key ID and ARN. Disabled keys, asymmetric and HMAC keys, and AWS managed keys are not evaluated.

Rationale

If the same key material is used for a long time, more data depends on it, and a compromise of that key material exposes everything encrypted with it until the key changes. Automatic rotation limits how much data is protected by any single version of the key material, supports crypto agility and helps meet rotation requirements in security policies and compliance frameworks.

Impact

  • Limits the amount of data protected by a single version of key material

  • No change is needed in applications: the key ID, ARN, aliases and permissions stay the same, and data encrypted with older key material can still be decrypted

  • AWS KMS charges a monthly fee for each rotated version of key material that is kept, up to a limit per key

Default Value

Automatic rotation is disabled by default for customer managed keys. When it is enabled, the default rotation period is 365 days.

Pre-Requisites

  • IAM permissions: kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus, kms:EnableKeyRotation and kms:DisableKeyRotation

  • The rotation period to use (90 to 2560 days, 365 by default), as required by your security policy

  • Keys with imported key material or keys in a custom key store do not support automatic rotation and must be rotated manually

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Key Management Service (KMS) console and select Customer managed keys.

  3. Select each key with status Enabled and key type Symmetric used for encryption.

  4. Open the Key rotation tab and check whether automatic rotation is enabled.

  5. Repeat for each region in use.

  6. If automatic rotation is disabled for any such key, follow the implementation steps.

CLI:

List the keys in the region:

aws kms list-keys --region <REGION> --query "Keys[].KeyId" --output table

Show the manager, state and key spec of a key:

aws kms describe-key --region <REGION> --key-id <KEY_ID> --query "KeyMetadata.[KeyId,KeyManager,KeyState,KeySpec,Origin]" --output table

For keys with KeyManager CUSTOMER, KeyState Enabled and KeySpec SYMMETRIC_DEFAULT, show the rotation status:

aws kms get-key-rotation-status --region <REGION> --key-id <KEY_ID>

A key fails if it is a customer managed, enabled, symmetric encryption key and KeyRotationEnabled is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Key Management Service (KMS) console and select Customer managed keys.

  3. Select the affected key and open the Key rotation tab.

  4. Choose Edit.

  5. Turn on automatic key rotation and, if needed, set the rotation period in days.

  6. Choose Save.

  7. Repeat for each affected key in each region in use.

CLI:

Enable automatic rotation for a key:

aws kms enable-key-rotation --region <REGION> --key-id <KEY_ID>

To use a rotation period other than 365 days, add the period in days (90 to 2560), for example 180:

aws kms enable-key-rotation --region <REGION> --key-id <KEY_ID> --rotation-period-in-days 180

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Key Management Service (KMS) console and select Customer managed keys.

  3. Select the key and open the Key rotation tab.

  4. Choose Edit, turn off automatic key rotation and choose Save.

CLI:

aws kms disable-key-rotation --region <REGION> --key-id <KEY_ID>

Note: key material that has already been rotated is kept and cannot be removed, and data encrypted with it remains readable. Disabling rotation keeps the current key material in use indefinitely.

Reference