Symmetric CMKs should have encryption key rotation enabled

kms
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

AWS Key Management Service (KMS) allows for backing key rotation, which involves updating the key material tied to a Customer Managed Key (CMK). Rotation of symmetric keys is recommended to minimize the risk of key compromise, as it ensures new data is encrypted with a fresh key. Prior backing keys are retained for seamless decryption of previously encrypted data. Symmetric key rotation is automated annually, though it is not available for asymmetric keys.

Remediation

For instructions on enabling CMK key rotation in AWS KMS, refer to the AWS Key Rotation Guide.