Skip to main content

KMS Encryption Keys Should Be Rotated

More Info:​

Ensure KMS encryption keys are rotated within a period of 90 days.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GCP
  • CIS GCP 2.0.0
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the KMS Encryption Keys Rotation issue in GCP using the GCP console:

  1. Open the Google Cloud Console and select the project in which the KMS key is created.
  2. In the left navigation menu, click on the "Security" option and select "Encryption keys" from the drop-down menu.
  3. Select the KMS key for which you want to enable rotation.
  4. Click on the "Edit" button at the top of the page.
  5. In the "Edit key" dialog box, scroll down to the "Rotation" section.
  6. Toggle the switch for "Automatic key rotation" to "On".
  7. Set the "Rotation period" to a desired value. It is recommended to rotate the key once a year.
  8. Click on the "Save" button to save the changes.

After completing these steps, the KMS key rotation will be enabled, and the key will be automatically rotated based on the rotation period set by you. This will help to ensure that your encryption keys are updated and secure.

Using CLI

To remediate the KMS Encryption Keys rotation issue in GCP using GCP CLI, you can follow the below steps:

  1. Open the Google Cloud Console and select the project in which you want to remediate the issue.

  2. Open the Cloud Shell by clicking on the icon located at the top right corner of the console.

  3. Run the following command to list all the KMS encryption keys in your project:

gcloud kms keys list

  1. Identify the key that needs to be rotated.

  2. Run the following command to rotate the key:

gcloud kms keys rotate [KEY_NAME] --location [LOCATION] --keyring [KEYRING_NAME]

Replace [KEY_NAME], [LOCATION], and [KEYRING_NAME] with the actual values of the key that needs to be rotated.

  1. Confirm the rotation by running the following command:
gcloud kms keys describe [KEY_NAME] --location [LOCATION] --keyring [KEYRING_NAME]

This command will display the details of the key, including the rotation period.

  1. Repeat steps 5 and 6 for all the KMS encryption keys that need to be rotated.

By following these steps, you will be able to remediate the KMS Encryption Keys rotation issue in GCP using GCP CLI.

Using Python

To remediate this issue in GCP using Python, you can follow these steps:

  1. Install the necessary libraries:
pip install google-cloud-kms google-auth
  1. Authenticate with the GCP project:
from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
  1. Retrieve the list of KMS keys in the project:
from google.cloud import kms_v1

client = kms_v1.KeyManagementServiceClient(credentials=credentials)
parent = client.key_ring_path(project_id, location_id, key_ring_id)

keys = client.list_crypto_keys(parent)
  1. For each key, check the creation time and determine if it needs to be rotated:
from datetime import datetime, timedelta

for key in keys:
    create_time = datetime.strptime(key.create_time.strftime('%Y-%m-%d %H:%M:%S.%f'), '%Y-%m-%d %H:%M:%S.%f')
    if datetime.now() - create_time > timedelta(days=365):
        # Key needs to be rotated
        # Generate a new key version
        response = client.create_crypto_key_version(key.name)
  1. Finally, delete the old key versions:
for key in keys:
    versions = client.list_crypto_key_versions(key.name)
    for version in versions:
        create_time = datetime.strptime(version.create_time.strftime('%Y-%m-%d %H:%M:%S.%f'), '%Y-%m-%d %H:%M:%S.%f')
        if datetime.now() - create_time > timedelta(days=365):
            # Delete the key version
            client.destroy_crypto_key_version(version.name)

Note: Replace project_id, location_id, and key_ring_id with the appropriate values for your GCP project. Also, make sure that the service account used for authentication has the necessary permissions to manage KMS keys.

Using Terraform
resource "google_kms_key_ring" "EXISTING_KEY_RING" {
  name     = "EXISTING_KEY_RING_NAME"      # replace with your key ring name
  location = "EXISTING_KEY_RING_LOCATION"  # e.g. "us-central1"
  project  = "EXISTING_PROJECT_ID"
}

resource "google_kms_crypto_key" "EXISTING_CRYPTO_KEY" {
  name            = "EXISTING_CRYPTO_KEY_NAME"  # replace with your key name
  key_ring        = google_kms_key_ring.EXISTING_KEY_RING.id
  purpose         = "ENCRYPT_DECRYPT"

  // Rotate the key every 90 days
  rotation_period = "7776000s" # 90 days * 24h * 3600s

  // Optional but recommended: set an explicit next rotation time (RFC3339 UTC)
  next_rotation_time = "YYYY-MM-DDTHH:MM:SSZ" # replace with desired first rotation time
}

This config rotates the KMS crypto key every 90 days as required; changing rotation_period and next_rotation_time is in-place and does not force key replacement, but will schedule future key versions.

After updating your Terraform, terraform plan should show an in-place update on google_kms_crypto_key.EXISTING_CRYPTO_KEY changing rotation_period (and next_rotation_time if set), with no -/+ replacement.