KMS key must have automatic key rotation enabled
High
AWS
General
aws-kms-key-key-rotation
Applies to
AWS::KMS::Key
What CGPulse checks
A resource passes this rule when keyRotationEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.
How to fix it
Enable automatic key rotation to rotate backing key material annually while preserving the key ID. In AWS Console: KMS > Keys > select key > Key rotation > Enable. See: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
CLI
aws kms enable-key-rotation --key-id "{id}"Terraform
resource "aws_kms_key" "{name}" {
enable_key_rotation = true
}
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related AWS rules
- ACM certificate must be eligible for renewal
- ACM certificate must be in issued status
- Amplify app should have basic auth disabled for production
- API Gateway REST API must have an endpoint configuration
- API Gateway V2 API must be properly configured
- App Runner service must have encryption enabled
- AppSync API must have logging configured
- AppSync API must have X-Ray tracing enabled