📝 AWS KMS Symmetric CMK Rotation is not enabled 🟢

• Contextual name: 📝 Symmetric CMK Rotation is not enabled 🟢
• ID: /ce/ca/aws/kms/symmetric-cmk-rotation
• Located in: 📁 AWS KMS

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY
  • RELIABILITY

Similar Policies

• Cloud Conformity
  • Key Rotation Enabled
• Internal
  • dec-x-4d6fee7a

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-4d6fee7a	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS KMS Key
  • 🔌 AWS KMS Key - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the customer-created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.

Rationale

Rotating encryption keys helps reduce the potential impact of a compromised key as data encrypted with a new key cannot be accessed with a previous key that may have been exposed. Keys should be rotated every year, or upon event that would result in the compromise of that key.

Impact

Creation, management, and storage of CMKs may require additional time from an administrator.

Audit

From Console

1. Sign in to the AWS Management Console and open the KMS console at: https://console.aws.amazon.com/kms.

... see more

Remediation

Open File

Remediation

From Console

1. Sign in to the AWS Management Console and open the KMS console at: https://console.aws.amazon.com/kms.
2. In the left navigation pane, click Customer-managed keys.
3. Select a key where Key spec = SYMMETRIC_DEFAULT that does not have automatic rotation enabled.
4. Select the Key rotation tab.
5. Check the Automatically rotate this KMS key every year checkbox.
6. Click Save.
7. Repeat steps 3–6 for all customer-managed CMKs that do not have automatic rotation enabled.

From Command Line

1. Run the following command to enable key rotation:

aws kms enable-key-rotation --key-id <kms_key_id>

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 4 Cryptographic key management refers to the generation, distribution, storage, renewal, revocation, recovery, archiving and destruction of encryption keys. Effective cryptographic key management ensures that controls are in place to reduce the risk of compromise of the security of cryptographic keys. Any compromise of the security of cryptographic keys could, in turn, lead to a compromise of the security of the information assets protected by the cryptographic technique deployed.		6	7
💼 APRA CPG 234 → 💼 4 Regulated entities would typically put in place processes to ensure that identities and credentials are issued, managed, verified, revoked and audited for authorised devices, users and software/processes.		8	8
💼 APRA CPG 234 → 💼 36e hardware and software asset controls —appropriate authorisation to prevent security compromises from unauthorised hardware and software assets;		15	16
💼 APRA CPG 234 → 💼 44c loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.		8	10
💼 APRA CPG 234 → 💼 d. predefined activation and deactivation dates for cryptographic keys, limiting the period of time they remain valid for use. The period of time a cryptographic key remains valid would be commensurate with the risk;		3	4
💼 CIS AWS v1.2.0 → 💼 2.8 Ensure rotation for customer created CMKs is enabled		1	1
💼 CIS AWS v1.3.0 → 💼 3.8 Ensure rotation for customer created CMKs is enabled		1	1
💼 CIS AWS v1.4.0 → 💼 3.8 Ensure rotation for customer created CMKs is enabled		1	1
💼 CIS AWS v1.5.0 → 💼 3.8 Ensure rotation for customer created symmetric CMKs is enabled - Level 2 (Automated)		1	1
💼 CIS AWS v2.0.0 → 💼 3.8 Ensure rotation for customer created symmetric CMKs is enabled - Level 2 (Automated)		1	1
💼 CIS AWS v3.0.0 → 💼 3.6 Ensure rotation for customer-created symmetric CMKs is enabled - Level 2 (Automated)		1	1
💼 CIS AWS v4.0.0 → 💼 3.6 Ensure rotation for customer-created symmetric CMKs is enabled (Automated)			1
💼 CIS AWS v4.0.1 → 💼 3.6 Ensure rotation for customer-created symmetric CMKs is enabled (Automated)			1
💼 CIS AWS v5.0.0 → 💼 3.6 Ensure rotation for customer-created symmetric CMKs is enabled (Automated)			1
💼 Cloudaware Framework → 💼 Expiration Management			12
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	20
💼 FedRAMP High Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)	1	9	11
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)		5	12
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		20
💼 FedRAMP Low Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		20
💼 FedRAMP Moderate Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 GDPR → 💼 Art. 25 Data protection by design and by default		10	10
💼 ISO/IEC 27001:2013 → 💼 A.9.2.4 Management of secret authentication information of users		8	10
💼 ISO/IEC 27001:2013 → 💼 A.10.1.2 Key management		9	11
💼 ISO/IEC 27001:2022 → 💼 5.33 Protection of records		10	10
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods		19	22
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors		19	22
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated		30	33
💼 NIST CSF v1.1 → 💼 ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations		16	19
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	22
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	22
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	19
💼 NIST CSF v1.1 → 💼 PR.DS-2: Data-in-transit is protected		14	21
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy		17	20
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated		19	22
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria		20	23
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities			26
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources			26
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools			33
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis			22
💼 NIST CSF v2.0 → 💼 GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship			26
💼 NIST CSF v2.0 → 💼 ID.RA-10: Critical suppliers are assessed prior to acquisition			26
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			23
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			22
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			57
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			81
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			68
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging			23
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents			30
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated			22
💼 NIST SP 800-53 Revision 4 → 💼 AC-2 (7) ROLE-BASED SCHEMES		1	1
💼 NIST SP 800-53 Revision 4 → 💼 AC-6 (10) PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED FUNCTIONS		1	1
💼 NIST SP 800-53 Revision 4 → 💼 AU-6 AUDIT REVIEW, ANALYSIS, AND REPORTING	10	2	2
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection		10	12
💼 SOC 2 → 💼 CC6.1-10 Uses Encryption to Protect Data		6	6
💼 SOC 2 → 💼 CC6.1-11 Protects Encryption Keys		6	8