Skip to content

AWS KMS key rotation should be enabled

Identifier

kms-enable-key-rotation

Category

Protect > Data protection > Encryption of data at rest

Description

This control checks whether AWS Key Management Service (KMS) Customer Master Keys (CMKs) have automatic key rotation enabled. Enabling key rotation helps improve security by periodically rotating cryptographic keys, reducing the risk of key compromise. This is verified by ensuring that the enable_key_rotation attribute is set to true in the Terraform configuration for the aws_kms_key resource.

Non Compliant Example

Terraform
1
2
3
4
resource "aws_kms_key" "foo" {
  description             = "foo"
  deletion_window_in_days = 10
}

Remediation

To fix this violation, enable key rotation by setting the enable_key_rotation attribute to true:

Terraform
1
2
3
4
5
resource "aws_kms_key" "foo" {
  description             = "foo"
  deletion_window_in_days = 10
  enable_key_rotation     = true
}

Extra Resources