Back to Checks
oraclecloud

Customer-managed KMS key has rotation enabled with interval of 365 days or less

kms_key_rotation_enabled
Service: kmsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Key

OCI KMS customer-managed keys configured for automatic rotation, with a rotation interval set to <= 365 days, or manually rotated within the last 365 days. Some vault types do not support auto-rotation, so manual rotation is accepted as an alternative.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without regular rotation, a compromised key can be used longer to decrypt data at rest and backups or to forge signatures. This erodes confidentiality and integrity, increases the blast radius, and complicates incident response due to broad reuse of the same key version.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks kms_key_rotation_enabled

Recommendation

Enable automatic key rotation and set an interval <= 365 days (shorter for sensitive data). For vault types that do not support auto-rotation (e.g., External or Virtual Private vaults), manually rotate the key at least once every 365 days. Apply least privilege and separation of duties for key administration. Monitor rotation status, retire old key versions, and ensure applications handle key versioning to prevent outages.

Remediation

CLI

oci kms management key update --key-id <example_resource_id> --endpoint <example_management_endpoint> --is-auto-rotation-enabled true --auto-key-rotation-details '{"rotationIntervalInDays": 365}'

Terraform

resource "oci_kms_key" "<example_resource_name>" {
  compartment_id      = "<example_resource_id>"
  display_name        = "<example_resource_name>"
  management_endpoint = "<example_management_endpoint>"

  key_shape {
    algorithm = "AES"
    length    = 16
  }

  is_auto_rotation_enabled = true  # Critical: enables auto rotation
  auto_key_rotation_details {
    rotation_interval_in_days = 365  # Critical: interval <= 365 days
  }
}

Other

1In OCI Console, go to Identity & Security > Vault
2Open the vault, then under Resources select Master Encryption Keys
3Click the target key name
4For vaults that support auto-rotation: Click Edit auto-rotation settings, enable Auto rotation, set Rotation interval to 365 days (or less), and click Update
5For vaults that do not support auto-rotation (e.g., External or Virtual Private vaults): Click 'Rotate Key' to manually rotate the key version at least once every 365 days

Check Code

"""Check Ensure customer created Customer Managed Key (CMK) is rotated at least annually."""

from datetime import datetime, timedelta, timezone

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.kms.kms_client import kms_client


class kms_key_rotation_enabled(Check):
    """Check Ensure customer created Customer Managed Key (CMK) is rotated at least annually."""

    def execute(self) -> Check_Report_OCI:
        """Execute the kms_key_rotation_enabled check."""
        findings = []

        for key in kms_client.keys:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=key,
                region=key.region,
                resource_name=key.name,
                resource_id=key.id,
                compartment_id=key.compartment_id,
            )

            now = datetime.now(timezone.utc)
            max_age = timedelta(days=365)

            manually_rotated_recently = (
                key.current_key_version_time_created is not None
                and (now - key.current_key_version_time_created) <= max_age
            )

            if (
                key.is_auto_rotation_enabled
                or (
                    key.rotation_interval_in_days is not None
                    and key.rotation_interval_in_days <= 365
                )
                or manually_rotated_recently
            ):
                report.status = "PASS"
                if key.is_auto_rotation_enabled:
                    report.status_extended = f"KMS key {key.name} has auto-rotation enabled with interval of {key.rotation_interval_in_days} days."
                elif manually_rotated_recently:
                    report.status_extended = f"KMS key {key.name} was manually rotated within the last 365 days."
                else:
                    report.status_extended = f"KMS key {key.name} has rotation interval set to {key.rotation_interval_in_days} days."
            else:
                report.status = "FAIL"
                report.status_extended = f"KMS key {key.name} has not been rotated within the last 365 days and does not have auto-rotation enabled."

            findings.append(report)

        return findings

References