🛡️ Oracle Key Vault Customer Managed Key is not rotated annually🟢

• Contextual name: 🛡️ Customer Managed Key is not rotated annually🟢
• ID: /ce/ca/oracle/key-vault/cmk-not-rotated-annually
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Oracle Key Vault Key
  • 🔌 Oracle Key Vault Key - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Internal: dec-x-e467c0fb

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-e467c0fb	1

Description

Open File

Description

This policy identifies enabled Oracle Key Vault keys that are older than 365 days and do not have automatic rotation enabled. Oracle Cloud Infrastructure Vault stores master encryption keys that protect encrypted data.

Rationale

Rotating customer managed keys annually limits the amount of data encrypted by one key version and reduces the impact of a potential key compromise. Automatic rotation provides a consistent rotation schedule and reduces the chance that long-lived key material remains in use.

Impact

Rotating a key creates new cryptographic material while retaining prior key versions for decrypting existing data. Review dependent services and operational procedures before rotating production keys. If automatic rotation is enabled, confirm that the setting aligns with the organization's key management standard.

Audit

This policy flags an enabled Oracle Key Vault Key as INCOMPLIANT when Auto Rotation Status is not Enabled and the Time Created field is older than 365 days.

Enabled keys are marked as COMPLIANT when Auto Rotation Status is Enabled or when the Time Created value is within the last 365 days. Keys that are not in the ENABLED lifecycle state are marked as INAPPLICABLE.

Remediation

Open File

Remediation

Rotate Stale Customer Managed Keys

Rotate each enabled customer managed key that is older than 365 days and does not have automatic rotation enabled. Where supported and appropriate for the workload, enable automatic rotation to keep the key on a consistent rotation schedule.

From OCI CLI

Rotate the key:

oci kms management key rotate \
    --key-id {{key-ocid}} \
    --endpoint {{management-endpoint-url}}

Confirm the key remains enabled after rotation:

oci kms management key get \
    --key-id {{key-ocid}} \
    --endpoint {{management-endpoint-url}}

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 44c loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.		11	13		no data
💼 CIS Oracle v3.1.0 → 💼 4.16 Ensure customer created Customer Managed Key (CMK) is rotated at least annually - Level 1 (Automated)		1	1		no data
💼 Cloudaware Framework → 💼 Expiration Management			22		no data
💼 FedRAMP High Security Controls → 💼 AC-2(3) Disable Accounts (M)(H)			9		no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(3) Disable Accounts (M)(H)			9		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(3) Account Management _ Disable Accounts		4	9		no data