AWS KMS CMK Key Rotation Is Enabled


Remediation Effort



This policy validates that customer master keys (CMKs) have automatic key rotation enabled.

Regular key rotation is an important security best practice as it reduces the useful lifetime of potentially compromised keys. It also means if old key pairs are compromised, they will not pose a risk of data loss.


To remediate this, enable CMK key rotation for each key listed in the report.

Using the AWS Console

1. Navigate to the customer managed key tab of the AWS KMS Console.

2. Select the key where key rotation is not enabled.

3. Select the "Key rotation" tab.

4. Check the "Automatically rotate this CMK every year" checkbox, then select the "Save" button.

Using the AWS CLI

1. Run the following command:

aws kms enable-key-rotation --key-id <kms_key_id>


Automatic key rotation rotates the keys once every year. Automatically rotating keys will have no impact on your ability to decrypt data, as Amazon stores the previous keys for decryption purposes. Additionally, systems that refer to the KMS Key by ARN or Key ID do not need to be updated to point to the new key. There is a small cost of $1 per previous key stored per year, so with automatic key rotation enabled your AWS spend will increase by $1 per key per year, every year.



AWS Cost

$1 increase per key per year

KMS Key Usability


KMS Key Performance



  • CIS AWS Benchmark 2.8 "Ensure rotation for customer created CMKs is enabled"

  • See the AWS documentation for more details on pricing impact

Last updated