AWS KMS CMK Key Rotation Is Enabled
Risk
Remediation Effort
High
Low
This policy validates that customer master keys (CMKs) have automatic key rotation enabled.
Regular key rotation is an important security best practice as it reduces the useful lifetime of potentially compromised keys. It also means if old key pairs are compromised, they will not pose a risk of data loss.
Remediation
To remediate this, enable CMK key rotation for each key listed in the report.
Using the AWS Console
2. Select the key where key rotation is not enabled.
3. Select the "Key rotation" tab.
4. Check the "Automatically rotate this CMK every year" checkbox, then select the "Save" button.
Using the AWS CLI
1. Run the following command:
aws kms enable-key-rotation --key-id <kms_key_id>Impact
Automatic key rotation rotates the keys once every year. Automatically rotating keys will have no impact on your ability to decrypt data, as Amazon stores the previous keys for decryption purposes. Additionally, systems that refer to the KMS Key by ARN or Key ID do not need to be updated to point to the new key. There is a small cost of $1 per previous key stored per year, so with automatic key rotation enabled your AWS spend will increase by $1 per key per year, every year.
Aspect
Impact
AWS Cost
$1 increase per key per year
KMS Key Usability
None
KMS Key Performance
None
References
- CIS AWS Benchmark 2.8 "Ensure rotation for customer created CMKs is enabled"
Copy link
Contents
Impact