# Ensure rotation for customer created CMKs is enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292217445877-ensure-rotation-for-customer-created-cmks-is-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that automatic key rotation is enabled for every customer managed AWS KMS key that is enabled and of the symmetric encryption type (SYMMETRIC\_DEFAULT). With automatic rotation, AWS KMS creates new key material on a regular schedule while keeping the same key ID and ARN. Disabled keys, asymmetric and HMAC keys, and AWS managed keys are not evaluated. **Rationale** If the same key material is used for a long time, more data depends on it, and a compromise of that key material exposes everything encrypted with it until the key changes. Automatic rotation limits how much data is protected by any single version of the key material, supports crypto agility and helps meet rotation requirements in security policies and compliance frameworks. **Impact** - Limits the amount of data protected by a single version of key material - No change is needed in applications: the key ID, ARN, aliases and permissions stay the same, and data encrypted with older key material can still be decrypted - AWS KMS charges a monthly fee for each rotated version of key material that is kept, up to a limit per key **Default Value** Automatic rotation is disabled by default for customer managed keys. When it is enabled, the default rotation period is 365 days. **Pre-Requisites** - IAM permissions: kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus, kms:EnableKeyRotation and kms:DisableKeyRotation - The rotation period to use (90 to 2560 days, 365 by default), as required by your security policy - Keys with imported key material or keys in a custom key store do not support automatic rotation and must be rotated manually **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Key Management Service (KMS) console and select **Customer managed keys**. 3. Select each key with status **Enabled** and key type **Symmetric** used for encryption. 4. Open the **Key rotation** tab and check whether automatic rotation is enabled. 5. Repeat for each region in use. 6. If automatic rotation is disabled for any such key, follow the implementation steps. **CLI:** List the keys in the region: aws kms list-keys --region --query "Keys\[\].KeyId" --output table Show the manager, state and key spec of a key: aws kms describe-key --region --key-id --query "KeyMetadata.\[KeyId,KeyManager,KeyState,KeySpec,Origin\]" --output table For keys with KeyManager CUSTOMER, KeyState Enabled and KeySpec SYMMETRIC\_DEFAULT, show the rotation status: aws kms get-key-rotation-status --region --key-id A key fails if it is a customer managed, enabled, symmetric encryption key and KeyRotationEnabled is false. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Key Management Service (KMS) console and select **Customer managed keys**. 3. Select the affected key and open the **Key rotation** tab. 4. Choose **Edit**. 5. Turn on automatic key rotation and, if needed, set the rotation period in days. 6. Choose **Save**. 7. Repeat for each affected key in each region in use. **CLI:** Enable automatic rotation for a key: aws kms enable-key-rotation --region --key-id To use a rotation period other than 365 days, add the period in days (90 to 2560), for example 180: aws kms enable-key-rotation --region --key-id --rotation-period-in-days 180 **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Key Management Service (KMS) console and select **Customer managed keys**. 3. Select the key and open the **Key rotation** tab. 4. Choose **Edit**, turn off automatic key rotation and choose **Save**. **CLI:** aws kms disable-key-rotation --region --key-id Note: key material that has already been rotated is kept and cannot be removed, and data encrypted with it remains readable. Disabling rotation keeps the current key material in use indefinitely. **Reference** - [https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) - [https://docs.aws.amazon.com/cli/latest/reference/kms/enable-key-rotation.html](https://docs.aws.amazon.com/cli/latest/reference/kms/enable-key-rotation.html) - [https://docs.aws.amazon.com/cli/latest/reference/kms/get-key-rotation-status.html](https://docs.aws.amazon.com/cli/latest/reference/kms/get-key-rotation-status.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.