Symmetric CMKs should have encryption key rotation enabled

kms
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

AWS Key Management Service (KMS) allows for backing key rotation, which involves updating the key material tied to a Customer Managed Key (CMK). Rotation of symmetric keys is recommended to minimize the risk of key compromise, as it ensures new data is encrypted with a fresh key. Prior backing keys are retained for seamless decryption of previously encrypted data. Symmetric key rotation is automated annually, though it is not available for asymmetric keys.

Remediation

For instructions on enabling CMK key rotation in AWS KMS, refer to the AWS Key Rotation Guide.