> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# KMS Key Rotation Should Be Enabled

### More Info:

When you enable automatic key rotation, AWS KMS rotates the CMK 365 days after the enable date and every 365 days thereafter.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the KMS Key Rotation misconfiguration in AWS using the AWS console:

        1. Log in to your AWS Management Console.
        2. Navigate to the AWS Key Management Service (KMS) dashboard.
        3. Select the KMS key that needs to be remediated.
        4. Click on the "Key policy" button to view the key policy.
        5. In the key policy, locate the "KeyRotationEnabled" statement. If it is not present, add it to the key policy.
        6. Set the value of "KeyRotationEnabled" to "true".
        7. Click on the "Save changes" button to save the updated key policy.

        After completing these steps, KMS key rotation will be enabled for the selected key. It is recommended to perform this remediation for all KMS keys used in your AWS environment.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "KMS Key Rotation Should Be Enabled" for AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine or in the AWS Management Console.

        2. Check if the KMS key rotation is enabled or not using the following command:

        ```
        aws kms get-key-rotation-status --key-id <key-id>
        ```

        Note: Replace `<key-id>` with the ID of the KMS key for which you want to check the rotation status.

        3. If the key rotation is not enabled, enable it using the following command:

        ```
        aws kms enable-key-rotation --key-id <key-id>
        ```

        Note: Replace `<key-id>` with the ID of the KMS key for which you want to enable the rotation.

        4. Verify if the key rotation is enabled using the following command:

        ```
        aws kms get-key-rotation-status --key-id <key-id>
        ```

        Note: Replace `<key-id>` with the ID of the KMS key for which you want to check the rotation status.

        5. Repeat steps 2-4 for all the KMS keys in your AWS account.

        By following these steps, you can remediate the misconfiguration "KMS Key Rotation Should Be Enabled" for AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate KMS Key Rotation Should Be Enabled in AWS, you can use the following steps in Python:

        1. Import the necessary libraries:

        ```
        import boto3
        ```

        2. Create a boto3 client for AWS Key Management Service:

        ```
        kms_client = boto3.client('kms')
        ```

        3. Get a list of all KMS keys:

        ```
        keys = kms_client.list_keys()
        ```

        4. Loop through each key and check if key rotation is enabled:

        ```
        for key in keys['Keys']:
            key_id = key['KeyId']
            key_rotation_status = kms_client.get_key_rotation_status(KeyId=key_id)
            if not key_rotation_status['KeyRotationEnabled']:
                # Enable key rotation
                kms_client.enable_key_rotation(KeyId=key_id)
        ```

        5. Save the Python script and run it to enable key rotation for all KMS keys.

        Note: Make sure you have appropriate AWS credentials with required permissions to perform this operation.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_kms_key" "THIS_KMS_KEY" {
          description             = "KMS key for PURPOSE_DESCRIPTION"
          key_usage               = "ENCRYPT_DECRYPT"
          customer_master_key_spec = "SYMMETRIC_DEFAULT"

          # Enable automatic yearly rotation (equivalent to
          # `aws kms enable-key-rotation --key-id ...`)
          enable_key_rotation = true

          # add any other required arguments you already use (policy, tags, etc.)
        }
        ```

        Replace:

        * `THIS_KMS_KEY` with your Terraform resource name.
        * `PURPOSE_DESCRIPTION` with a description of the key’s use.

        This setting only applies to customer‑managed symmetric KMS keys and cannot be used on AWS‑managed keys or keys with imported key material (same limitations as the CLI command). Changing `enable_key_rotation` from `false` to `true` is an in‑place update and does not force key replacement.

        To verify, `terraform plan` should show a single in‑place update on the `aws_kms_key` resource with:

        ```hcl theme={null}
        ~ enable_key_rotation: false => true
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)