AWS Customer Master Key (CMK) rotation is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_7
Category - Subcategory	IAM - Expired Key Controls
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	497f7e2c-b702-47c7-9a07-f0f6404ac896

Impact

This policy identifies Customer Master Keys (CMKs) that are not enabled with key rotation. AWS KMS (Key Management Service) allows customers to create master keys to encrypt sensitive data in different services. As a security best practice, it is important to rotate the keys periodically so that if the keys are compromised, the data in the underlying service is still secure with the new keys.

How to Fix

Resource: AWS::KMS::Key

• Attribute: EnableKeyRotation - (Optional) Specifies whether key rotation is enabled. Defaults to false. [source,go]

---

Type: AWS::KMS::Key Properties: ...

• EnableKeyRotation: true0

---