Alibaba Cloud KMS Key Rotation is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_27
Category - Subcategory	IAM - Expired Key Controls
Provider	ALIBABA_CLOUD
Severity	LOW
Framework	Terraform

Impact

This rule ensures that KMS (Key Management Service) Key Rotation is enabled for keys in Alibaba Cloud. Enabling automatic key rotation helps to maintain security by periodically changing the cryptographic keys, thereby reducing the risk of key compromise over time. KMS keys without automatic rotation enabled may be left vulnerable to prolonged exposure and potential unauthorized use.

How to Fix

Resource: alicloud_kms_key

• Arguments: automatic_rotation

To mitigate this issue, ensure the automatic_rotation attribute of the alicloud_kms_key resource is set to Enabled.

Example: [source,go]

resource "alicloud_kms_key" "example" { ...

• automatic_rotation = "Enabled" }

---