Automatically rotate CMKs quarterly

Question

Hi AWS enthusiast,

I am working on a project that require me to rotate the CMKs automatically each quarter.
Therefore, I create this case to ask for the solution to implement this requirement. Also, if you know any special consideration when implement this issue for example the services using the CMKs will be interrupted when rotatation, please notice me.

Thanks,
Steven

Answer

Automatic Key Rotation will rotate key material once per year https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works

There isn't a setting in KMS to make this happen more frequently, to rotate keys quarterly (as in your case) you would have to disable automatic key rotation and rotate the keys manually https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually

> You might prefer to rotate keys manually so you can control the rotation frequency

This knowledge document goes through the steps to do this https://repost.aws/knowledge-center/rotate-keys-customer-managed-kms and the accompanying video is at https://www.youtube.com/watch?v=zTIqkPfLNjI

Automatically rotate CMKs quarterly

Relevanter Inhalt