---
title: Symmetric CMKs should have encryption key rotation enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Symmetric CMKs should have encryption
  key rotation enabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Symmetric CMKs should have encryption key rotation enabled
 
## Description{% #description %}

AWS KMS customer-managed keys with a key spec of `SYMMETRIC_DEFAULT` should have automatic key rotation enabled so that new key material is generated every year. Rotating the backing key limits the impact of a key compromise while prior key material is retained to decrypt previously encrypted data. AWS-managed keys, asymmetric keys, and keys that are not in the `Enabled` state are not evaluated.

## Remediation{% #remediation %}

1. In the [AWS KMS console](https://console.aws.amazon.com/kms), open **Customer-managed keys**, select each `SYMMETRIC_DEFAULT` key without rotation, open the **Key rotation** tab, check **Automatically rotate this KMS key every year**, and click **Save**.
1. Alternatively, run `aws kms enable-key-rotation --key-id <kms-key-id>` as described in the [enable-key-rotation CLI reference](https://docs.aws.amazon.com/cli/latest/reference/kms/enable-key-rotation.html).

## References{% #references %}

- [Rotating AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)
- [AWS CLI enable-key-rotation](https://docs.aws.amazon.com/cli/latest/reference/kms/enable-key-rotation.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)