GCP KMS Symmetric key not rotating in every 90 days misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_43
Category - Subcategory	Storage - Alerting
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	6e394124-06d4-46fc-991e-4b6102ed74da

Impact

Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for access control management. The format for the rotation schedule depends on the client library used. In Terraform, the rotation period unit must be seconds. A key is a named object representing a cryptographic key used for a specific purpose, including data protection. The key material, the actual bits used for encryption, can change over time as new key versions are created. A collection of files could be encrypted with the same key and people with decrypt permissions on that key would be able to decrypt those files. We recommend you set a key rotation period, including start time. A key can be created with a specified rotation period, which is the time when new key versions are generated automatically. A key can also be created with a specified next rotation time.

How to Fix

Resource: google_kms_crypto_key

• Arguments: rotation_period [source,go]

---

resource "google_kms_crypto_key" "key" { name = "crypto-key-example" key_ring = google_kms_key_ring.keyring.id

• rotation_period = "7776000s" }

---