# Buggy code
def _parse_key(self, raw_key):
    key_dict = {}
    key_dict["id"] = key_dict["name"] = raw_key.get("KeyId")
    key_dict["arn"] = raw_key.get("KeyArn")
    key_dict["rotation_enabled"] = (
        raw_key["rotation_status"]["KeyRotationEnabled"]
        if "rotation_status" in raw_key
        else None
    )

    key_dict["policy"] = raw_key.get("policy")

    if "metadata" in raw_key:
        key_dict["creation_date"] = (
            raw_key["metadata"]["KeyMetadata"]["CreationDate"]
            if raw_key["metadata"]["KeyMetadata"]["CreationDate"]
            else None
        )
        key_dict["key_enabled"] = (
            False
            if raw_key["metadata"]["KeyMetadata"]["KeyState"] == "Disabled"
            else True
        )
        key_dict["description"] = (
            raw_key["metadata"]["KeyMetadata"]["Description"]
            if len(raw_key["metadata"]["KeyMetadata"]["Description"].strip()) > 0
            else None
        )
        key_dict["origin"] = (
            raw_key["metadata"]["KeyMetadata"]["Origin"]
            if len(raw_key["metadata"]["KeyMetadata"]["Origin"].strip()) > 0
            else None
        )
        key_dict["key_manager"] = (
            raw_key["metadata"]["KeyMetadata"]["KeyManager"]
            if len(raw_key["metadata"]["KeyMetadata"]["KeyManager"].strip()) > 0
            else None
        )

    key_dict["aliases"] = {}
    for raw_alias in raw_key.get("aliases", []):
        alias_id, alias = self._parse_alias(raw_alias)
        key_dict["aliases"][alias_id] = alias

    return key_dict["id"], key_dict


# Traceback (botocore.exceptions.ClientError)
Traceback (most recent call last):
File "<redactedPath>env/lib/python3.7/site-packages/ScoutSuite/providers/aws/facade/kms.py", line 41, in _get_and_set_key_rotation_status
lambda: client.get_key_rotation_status(KeyId=key['KeyId']))
File "<redactedPath>env/lib/python3.7/site-packages/ScoutSuite/providers/utils.py", line 24, in run_concurrently
return await run_function_concurrently(function)
File "<redactedPath>/.pyenv/versions/3.7.2/lib/python3.7/concurrent/futures/thread.py", line 57, in run
result = self.fn(*self.args, **self.kwargs)
File "<redactedPath>env/lib/python3.7/site-packages/ScoutSuite/providers/aws/facade/kms.py", line 41, in <lambda>
lambda: client.get_key_rotation_status(KeyId=key['KeyId']))
File "<redactedPath>env/lib/python3.7/site-packages/botocore/client.py", line 316, in _api_call
return self._make_api_call(operation_name, kwargs)
File "<redactedPath>env/lib/python3.7/site-packages/botocore/client.py", line 626, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetKeyRotationStatus operation: User: arn:aws:sts::<redacted>:assumed-role/<redacted>/<redacted> is not authorized to perform: kms:GetKeyRotationStatus on resource: arn:aws:kms:us-east-1:<redacted>:key/<redacted>

# Fixed code
async def _parse_key(self, raw_key):
    key_dict = {}
    key_dict["id"] = key_dict["name"] = raw_key.get("KeyId")
    key_dict["arn"] = raw_key.get("KeyArn")
    key_dict["policy"] = raw_key.get("policy")

    if "metadata" in raw_key:
        key_dict["creation_date"] = (
            raw_key["metadata"]["KeyMetadata"]["CreationDate"]
            if raw_key["metadata"]["KeyMetadata"]["CreationDate"]
            else None
        )
        key_dict["key_enabled"] = (
            False
            if raw_key["metadata"]["KeyMetadata"]["KeyState"] == "Disabled"
            else True
        )
        key_dict["description"] = (
            raw_key["metadata"]["KeyMetadata"]["Description"]
            if len(raw_key["metadata"]["KeyMetadata"]["Description"].strip()) > 0
            else None
        )
        key_dict["origin"] = (
            raw_key["metadata"]["KeyMetadata"]["Origin"]
            if len(raw_key["metadata"]["KeyMetadata"]["Origin"].strip()) > 0
            else None
        )
        key_dict["key_manager"] = (
            raw_key["metadata"]["KeyMetadata"]["KeyManager"]
            if len(raw_key["metadata"]["KeyMetadata"]["KeyManager"].strip()) > 0
            else None
        )

    # Only call this on customer managed CMKs, otherwise the AWS set policies might disallow access and it's always
    # enabled anyway
    if key_dict["origin"] == "AWS_KMS" and key_dict["key_manager"] == "CUSTOMER":
        rotation_status = await self.facade.kms.get_key_rotation_status(
            self.region, key_dict["id"]
        )
        key_dict["rotation_enabled"] = rotation_status.get("KeyRotationEnabled", None)
    else:
        key_dict["rotation_enabled"] = True

    key_dict["aliases"] = []
    for raw_alias in raw_key.get("aliases", []):
        key_dict["aliases"].append(self._parse_alias(raw_alias))

    return key_dict["id"], key_dict