AWSOverview
AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled.
Rationale
Rotating encryption keys helps reduce the potential impact of a compromised key as data encrypted with a new key cannot be accessed with a previous key that may have been exposed.
Remediation guidance
Via the Management Console
- Open the security settings using the "Open in AWS" menu option
- Under
Key rotation, check theAutomatically rotate this KMS key every yearcheckbox - Select the customer-managed KMS key
- Under the
Key Policysection, move down toKey Rotation
Via CLI
Run the following command to enable key rotation for the affected key:
aws kms enable-key-rotation \
--key-id {{asset.idFromProvider}}
Optional: verify the status after the update completes.
aws kms get-key-rotation-status \
--key-id {{asset.idFromProvider}}
References
- https://docs.aws.amazon.com/cli/latest/reference/kms/enable-key-rotation.html
- https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
- CCE-78920-6
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
AWS
Use AWS Organizations guardrails, AWS Config rules or conformance packs where they fit, approved account baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Rotation for customer created CMKs is enabled
Connectors
Covered asset types
Expected check: eq []
kmsKeys(where:{automaticRotationEnabled:false, managementType:"CustomerManaged"}){...AssetFragment}
