Back to Checks
gcp

KMS key has automatic rotation enabled

kms_key_rotation_enabled
Service: kmsSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:cloudkms.googleapis.com/CryptoKey

Google Cloud KMS customer-managed keys have automatic rotation enabled, regardless of the rotation interval.

The evaluation reviews each key's rotation settings to confirm that a rotation period is configured so new key versions are created periodically.

Prowler logoProwlerprowler-provider-gcp

Risk

Without timely rotation, a stolen key can decrypt an expanding volume of data, eroding confidentiality. Prolonged key lifetimes widen windows for misuse, impact integrity of protected workloads, and make emergency rollover harder, risking availability disruptions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks kms_key_rotation_enabled

Recommendation

Enable auto-rotation for customer-managed keys by configuring a rotation period.

Adopt a key lifecycle policy: enforce least privilege on key usage, apply separation of duties between key admins and users, monitor key access, and rehearse emergency rotation to minimize blast radius.

Remediation

CLI

gcloud kms keys update <KEY_NAME> --keyring=<KEY_RING> --location=<LOCATION> --rotation-period=<PERIOD> --next-rotation-time=<RFC3339_TIME>

Terraform

resource "google_kms_crypto_key" "<example_resource_name>" {
  name     = "<example_resource_name>"
  key_ring = "<example_resource_id>"
  purpose  = "ENCRYPT_DECRYPT"

  rotation_period = "7776000s" # Critical: enables automatic rotation (any period ensures PASS)
}

Other

1In Google Cloud Console, go to Security > Key Management > Key rings
2Open the key ring and select the key
3Click Edit rotation schedule (or Set rotation schedule)
4Set a Rotation period
5Set Next rotation date/time
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.kms.kms_client import kms_client


class kms_key_rotation_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for key in kms_client.crypto_keys:
            report = Check_Report_GCP(metadata=self.metadata(), resource=key)
            if key.rotation_period:
                report.status = "PASS"
                report.status_extended = (
                    f"Key {key.name} has automatic rotation enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Key {key.name} does not have automatic rotation enabled."
                )
            findings.append(report)

        return findings

References