Project: KICS (Provisioning / Security & Compliance)
File: 1c07bfaf-663c-4f6f-b22b-8e2d481e4df5.md

title: CMK Rotation Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1c07bfaf-663c-4f6f-b22b-8e2d481e4df5 Query name: CMK Rotation Disabled Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Customer Master Keys (CMK) must have rotation enabled, which means the attribute 'EnableKeyRotation' must be set to 'true' when the key is enabled.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5 31" Resources: myKey: Type: AWS::KMS::Key Properties: Enabled: true KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: '' - 'arn:aws:iam::' Ref: AWS::AccountId :root Action: kms:* Resource: '*' Tags: Key: Ref: Key Value: Ref: Value myKey2: Type: AWS::KMS::Key Properties: Enabled: true EnableKeyRotation: false KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: '' - 'arn:aws:iam::' Ref: AWS::AccountId :root Action: kms:* Resource: '*' Tags: Key: Ref: Key Value: Ref: Value Parameters: Key: Type: String Value: Type: String ``` ```json title="Positive test num. 2 - json file" hl_lines="49 5" { "Resources": { "myKey": { "Type": "AWS::KMS::Key", "Properties": { "Enabled": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*", "Sid": "Enable IAM User Permissions" } ] }, "Tags": [ { "Key": { "Ref": "Key" }, "Value": { "Ref": "Value" } } ] } }, "myKey2": { "Type": "AWS::KMS::Key", "Properties": { "Enabled": true, "EnableKeyRotation": false, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" } ] }, "Tags": [ { "Key": { "Ref": "Key" }, "Value": { "Ref": "Value" } } ] } } }, "Parameters": { "Key": { "Type": "String" }, "Value": { "Type": "String" } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: myKey: Type: AWS::KMS::Key Properties: Enabled: true EnableKeyRotation: true KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: '' - 'arn:aws:iam::' Ref: AWS::AccountId :root Action: kms:* Resource: '*' Tags: Key: Ref: Key Value: Ref: Value Parameters: Key: Type: String Value: Type: String ``` ```json title="Negative test num. 2 - json file" { "Resources": { "myKey": { "Type": "AWS::KMS::Key", "Properties": { "Enabled": true, "EnableKeyRotation": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" } ] }, "Tags": [ { "Key": { "Ref": "Key" }, "Value": { "Ref": "Value" } } ] } } }, "Parameters": { "Key": { "Type": "String" }, "Value": { "Type": "String" } } } ```