KMS keys should be rotated at least every 90 days

GCP-0065

Service: kmsSeverity: high

OfficialBuilt-inVerified

Keys should be rotated on a regular basis to limit exposure if a given key should become compromised.

Prowler prowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud

Run

prowler iac --checks GCP-0065

Recommendation

Set key rotation period to 90 days

Check Code

# METADATA
# title: KMS keys should be rotated at least every 90 days
# description: |
#   Keys should be rotated on a regular basis to limit exposure if a given key should become compromised.
# scope: package
# schemas:
#   - input: schema["cloud"]
# custom:
#   id: GCP-0065
#   long_id: google-kms-rotate-kms-keys
#   aliases:
#     - AVD-GCP-0065
#     - rotate-kms-keys
#     - google-kms-rotate-kms-keys
#   provider: google
#   service: kms
#   severity: HIGH
#   recommended_action: Set key rotation period to 90 days
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: kms
#             provider: google
#   examples: checks/cloud/google/kms/rotate_kms_keys.yaml
package builtin.google.kms.google0065

import rego.v1

deny contains res if {
	some ring in input.google.kms.keyrings
	some key in ring.keys
	key.rotationperiodseconds.value > 7776000
	res := result.new("Key has a rotation period of more than 90 days.", key.rotationperiodseconds)
}