KMS key last rotated timestamp

0

How to I get the KMS key last rotated time stamp using CLI

1 個回答
1
已接受的答案

I didn't think you could check the rotated timestamps in the AWS CLI.

I thought I could get it with "get-key-rotation-status", but the documentation does not provide timestamp information.
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/get-key-rotation-status.html

How about checking CloudTrail events instead?
The "RotateKey" event is recorded in CloudTrail, so you can check the time of execution from here. https://docs.aws.amazon.com/kms/latest/developerguide/ct-rotatekey.html

With AWS CLI, it would look like this.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-cli.html#look-up-events-by-attributes

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RotateKey
profile picture
專家
已回答 10 個月前
  • The cloudtrail command was the right direction, but the command you provided as an example gets all RotateKey events. What should I do if I want to get it for a particular key?

  • If the ARN of the KMS key is known, it can be narrowed down by adding "--lookup-attributes" as follows. In the following command, replace "arn:aws:kms:region:AWS Account ID:key/Key ID" with the ARN of your KMS key.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RotateKey AttributeKey=ResourceName,AttributeValue=arn:aws:kms:region:AWS Account ID:key/Key ID
    
  • When I run this using boto3, it says

    Unauthorised API call has been made :Region - us-east-1, Service - cloudtrail,Action - LookupEvents
    

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南