AWS KMS CMK Key Rotation Is Enabled
This policy validates that customer master keys (CMKs) have automatic key rotation enabled.
Regular key rotation is an important security best practice as it reduces the useful lifetime of potentially compromised keys. It also means if old key pairs are compromised, they will not pose a risk of data loss.
To remediate this, enable CMK key rotation for each key listed in the report.
Automatic key rotation rotates the keys once every year. Automatically rotating keys will have no impact on your ability to decrypt data, as Amazon stores the previous keys for decryption purposes. Additionally, systems that refer to the KMS Key by ARN or Key ID do not need to be updated to point to the new key. There is a small cost of $1 per previous key stored per year, so with automatic key rotation enabled your AWS spend will increase by $1 per key per year, every year.