Project: KICS (Provisioning / Security & Compliance)
File: 235ca980-eb71-48f4-9030-df0c371029eb.md

title: KMS Key Rotation Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 235ca980-eb71-48f4-9030-df0c371029eb Query name: KMS Key Rotation Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: EnableKeyRotation should not be false or undefined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8 51" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: myKey: Type: AWS::KMS::Key Properties: Description: An example symmetric CMK EnableKeyRotation: false KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: arn:aws:iam::111122223333:root Action: kms:* Resource: '*' Sid: Allow administration of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Alice Action: kms:Create* kms:Describe* kms:Enable* kms:List* kms:Put* kms:Update* kms:Revoke* kms:Disable* kms:Get* kms:Delete* kms:ScheduleKeyDeletion kms:CancelKeyDeletion Resource: '*' Sid: Allow use of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Bob Action: kms:DescribeKey kms:Encrypt kms:Decrypt kms:ReEncrypt* kms:GenerateDataKey kms:GenerateDataKeyWithoutPlaintext Resource: '*' myKey2: Type: AWS::KMS::Key Properties: Description: An example symmetric CMK KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: arn:aws:iam::111122223333:root Action: kms:* Resource: '*' Sid: Allow administration of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Alice Action: kms:Create* kms:Describe* kms:Enable* kms:List* kms:Put* kms:Update* kms:Revoke* kms:Disable* kms:Get* kms:Delete* kms:ScheduleKeyDeletion kms:CancelKeyDeletion Resource: '*' Sid: Allow use of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Bob Action: kms:DescribeKey kms:Encrypt kms:Decrypt kms:ReEncrypt* kms:GenerateDataKey kms:GenerateDataKeyWithoutPlaintext Resource: '*' ``` ```json title="Positive test

2 - json file" hl_lines="65 60" { "Resources": { "myKey": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "kms:*", "Resource": "*" }, { "Principal": { "AWS": "arn:aws:iam::123456789012:user/Alice" }, "Action": [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ], "Resource": "*", "Sid": "Allow administration of the key", "Effect": "Allow" }, { "Sid": "Allow use of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Bob" }, "Action": [ "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" } ] }, "Description": "An example symmetric CMK", "EnableKeyRotation": false } }, "myKey2": { "Type": "AWS::KMS::Key", "Properties": { "Description": "An example symmetric CMK", "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "kms:*", "Resource": "*" }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Alice" }, "Action": [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ], "Resource": "*", "Sid": "Allow administration of the key" }, { "Action": [ "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Sid": "Allow use of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Bob" } } ] } } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: myKey: Type: AWS::KMS::Key Properties: Description: An example symmetric CMK EnableKeyRotation: True KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: arn:aws:iam::111122223333:root Action: kms:* Resource: '*' Sid: Allow administration of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Alice Action: kms:Create* kms:Describe* kms:Enable* kms:List* kms:Put* kms:Update* kms:Revoke* kms:Disable* kms:Get* kms:Delete* kms:ScheduleKeyDeletion kms:CancelKeyDeletion Resource: '*' Sid: Allow use of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Bob Action: kms:DescribeKey kms:Encrypt kms:Decrypt kms:ReEncrypt* kms:GenerateDataKey kms:GenerateDataKeyWithoutPlaintext Resource: '*' ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "myKey": { "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "kms:*", "Resource": "*" }, { "Action": [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ], "Resource": "*", "Sid": "Allow administration of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Alice" } }, { "Sid": "Allow use of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Bob" }, "Action": [ "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" } ], "Version": "2012-10-17" }, "Description": "An example symmetric CMK" }, "Type": "AWS::KMS::Key" } } } ```