Guides

Ensure rotation for customer created CMKs is enabled

AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled.

Suggest Edits

Risk Level: Low
Cloud Entity: AWS Key Management Service (KMS)
CloudGuard Rule ID: D9.TF.AWS.LOG.08
Covered by Spectral: No
Category: Security, Identity, & Compliance

GSL LOGIC

aws_kms_key should not have enable_key_rotation=false or enable_key_rotation isEmpty()

REMEDIATION

  1. Run the following command to get a list of all keys and their associated KeyIds - aws kms list-keys 2. For each key, note the KeyId and run the following command - aws kms get-key-rotation-status --key-id <kms_key_id> 3. Ensure KeyRotationEnabled is set to true

AWS Key Management Service (KMS)

AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses FIPS 140-2 validated hardware security modules to protect the security of your keys. AWS Key Management Service is integrated with most other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

Compliance Frameworks

  • Terraform AWS CIS Foundations

Updated over 1 year ago