Skip to main content

🧠 AWS KMS Symmetric CMK Rotation is not enabled - prod.logic.yaml🟢

Uses​

Test Results 🟢​

Generated at: 2026-02-07T12:02:31.988104596Z Open

ResultIdCondition IndexCondition TextRuntime Error
🟢test1✔️ 99✔️ isDisappeared(CA10__disappearanceTime__c)✔️ null
🟢test2✔️ 201✔️ CA10__keySpec__c.delegatedTo(CA10__keySpec__c).isEmpty()✔️ null
🟢test3✔️ 299✔️ extract('CA10__keySpec__c') != 'SYMMETRIC_DEFAULT'✔️ null
🟢test4✔️ 399✔️ extract('CA10__rotationEnabled__c') == false✔️ null
🟢test5✔️ 499✔️ extract('CA10__rotationEnabled__c') == true✔️ null
🟢test6✔️ 199✔️ extract('CA10__manager__c') != 'CUSTOMER'✔️ null

Generation Bundle​

FileMD5
Open/ce/ca/aws/kms/symmetric-cmk-rotation/policy.yamlC1C8F96190B73FAEFA0E7DCEBC3BF34B
Open/ce/ca/aws/kms/symmetric-cmk-rotation/prod.logic.yamlE8FA265ED0CBE426B744803C3599F9A3
Open/ce/ca/aws/kms/symmetric-cmk-rotation/test-data.jsonAE63345233BAD5F3612A929D9B28B115
Open/types/CA10__CaAwsKmsKey__c/object.extracts.yamlEC6D0EFD0BFEAB3447A84529724D4AFE

Available Commands​

repo-manager policies generate FULL /ce/ca/aws/kms/symmetric-cmk-rotation/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/kms/symmetric-cmk-rotation/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/kms/symmetric-cmk-rotation/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/kms/symmetric-cmk-rotation/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/kms/symmetric-cmk-rotation/prod.logic.yaml

Content​

Open File

---
inputType: "CA10__CaAwsKmsKey__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10__CaAwsKmsKey__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "This Key is not Customer-managed."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10__manager__c"
        right:
          TEXT: "CUSTOMER"
  - status: "INAPPLICABLE"
    currentStateMessage: "KMS Key rotation can not be enabled for any asymmetric CMK."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10__keySpec__c"
        right:
          TEXT: "SYMMETRIC_DEFAULT"
  - status: "INCOMPLIANT"
    currentStateMessage: "AWS KMS Key rotation is disabled."
    remediationMessage: "Consider enabling KMS Key rotation."
    check:
      IS_EQUAL:
        left:
          EXTRACT: "CA10__rotationEnabled__c"
        right:
          BOOLEAN: false
  - status: "COMPLIANT"
    currentStateMessage: "AWS KMS Key rotation is enabled."
    check:
      IS_EQUAL:
        left:
          EXTRACT: "CA10__rotationEnabled__c"
        right:
          BOOLEAN: true
otherwise:
  status: "UNDETERMINED"
  currentStateMessage: "Unexpected values in the fields."