Back to Checks
aws

KMS customer-managed symmetric CMK has automatic rotation enabled

kms_cmk_rotation_enabled
Service: kmsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsKmsKey

Customer-managed KMS symmetric keys in the Enabled state are evaluated to confirm automatic rotation of key material is configured

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic rotation, long-lived key material increases confidentiality and integrity risk. If a KMS key is exposed, attackers can unwrap data keys and decrypt stored data until the key changes. It also reduces crypto agility and may conflict with mandated rotation policies.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kms_cmk_rotation_enabled

Recommendation

Enable automatic rotation on customer-managed symmetric KMS keys and choose a rotation period that meets policy. Enforce least privilege and separation of duties for key administration versus usage. Monitor key lifecycle events and use on-demand rotation when compromise is suspected.

Remediation

CLI

aws kms enable-key-rotation --key-id <KEY_ID>

Terraform

# KMS key with automatic rotation enabled
resource "aws_kms_key" "<example_resource_name>" {
  enable_key_rotation = true  # Critical: enables automatic rotation so the key passes the check
}

NativeIaC

# CloudFormation: KMS key with automatic rotation enabled
Resources:
  <example_resource_name>:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true  # Critical: enables automatic rotation so the key passes the check
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: "kms:*"
            Resource: "*"

Other

1In the AWS Console, go to Key Management Service (KMS)
2Open Customer managed keys and select the enabled symmetric key
3Go to the Key rotation section
4Check Enable automatic key rotation
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kms.kms_client import kms_client


class kms_cmk_rotation_enabled(Check):
    def execute(self):
        findings = []
        for key in kms_client.keys:
            report = Check_Report_AWS(metadata=self.metadata(), resource=key)
            # Only check enabled CMKs keys
            if (
                key.manager == "CUSTOMER"
                and key.state == "Enabled"
                and "SYMMETRIC" in key.spec
            ):
                if key.rotation_enabled:
                    report.status = "PASS"
                    report.status_extended = (
                        f"KMS CMK {key.id} has automatic rotation enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"KMS CMK {key.id} has automatic rotation disabled."
                    )
                findings.append(report)
        return findings

References