In AWS Key Management Service (KMS), automatic key rotation:
-
- Rotating the backing key material
- Keep the same Key ID and ARN
- Does NOT require re-encrypting existing data
- Does NOT require any code/config changes
Rotation happens once every year (365 days) automatically.
Enabling Annual Rotation (via AWS Console)
-
- Go to AWS Console
-
- Navigate to KMS → Customer managed keys
-
- Select your CMK
-
- Go to the Key rotation tab and click Edit
Enable: Automatically rotate this KMS key every year
-
- Save
Enable via AWS CLI
aws kms enable-key-rotation –key-id <your-key-id>
To verify:
aws kms get-key-rotation-status –key-id <your-key-id>
Expected output:
{
“KeyRotationEnabled”: true
}
Important Notes
-
- Only works for Customer Managed Keys
- Not supported for:
- AWS Managed Keys
- Imported key material
- Asymmetric keys (rotation is not supported)
- Rotation is automatic once enabled
- Old key material is retained to decrypt existing data
