En utilisant AWS re:Post, vous acceptez les AWS re:Post Conditions d’utilisation
AWS re:Postre:Post

KMS Key rotation when using RDS created by CloudFormation

0

We wish to enable KMS encryption at rest for our RDS instances, along with automatic (or manual) key rotation. When creating the RDS with CloudFormation, if you provide a KMS key alias it immediately resolves to the underlying key. If the key alias then points to a different key, the RDS instance will not be correctly rotated. As the KmsKeyId parameter is one that requires replacement, it is impossible to rotate KMS keys for RDS at all as long as it is managed by CloudFormation.

I have found this open issue of someone having a similar issue: https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1307

Is there a recommended way to enable KMS key rotation for RDS instances created by CloudFormation?

Sujets
Sécurité, identité et conformitéMigration et modernisationAnalytiqueBase de donnéesGestion et gouvernanceFramework AWS Well-Architected
Balises
Service AWS Key ManagementAmazon Relational Database ServiceAWS CloudFormationSécuritéChiffrement
Langue
English
Will
demandé il y a 10 mois512 vues
1 réponse
0

I suggest looking into the automatic key rotation feature within KMS: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

AWS
kumo-hiyori
répondu il y a 10 mois

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions

Contenus pertinents