AWS KMS: Enabling and Disabling Key Rotation

This guide covers the essential security task of managing the lifecycle of AWS Key Management Service (KMS) keys, specifically focusing on how to enable and disable keys and their automatic rotation policies.

Learning Objectives

After studying this guide, you should be able to:

• Differentiate between AWS Managed Keys and Customer Managed Keys regarding rotation capabilities.
• Identify the conditions under which automatic key rotation can be enabled or disabled.
• Understand the difference between disabling a key and disabling key rotation.
• Execute basic CLI commands to manage rotation status.

Key Terms & Glossary

• KMS Key (formerly CMK): A logical resource in AWS KMS that contains the metadata and references to the cryptographic material used to encrypt/decrypt data.
• Backing Key: The actual cryptographic material associated with a KMS key. When a key is rotated, KMS creates a new version of the backing key.
• Automatic Key Rotation: A feature where KMS generates new cryptographic material for a KMS key every year (for Customer Managed Keys) or every year (for AWS Managed Keys).
• Key State: The status of a key (Enabled, Disabled, Pending Deletion). A disabled key cannot be used for any cryptographic operations.

The "Big Idea"

[!IMPORTANT] The core purpose of key rotation is to reduce the blast radius. By changing the underlying cryptographic material regularly, you ensure that even if a specific version of a key were somehow compromised, the amount of data encrypted with that specific material is limited. AWS handles the complexity of keeping old backing keys available for decryption while using the newest material for all new encryption requests.

Formula / Concept Box

Hierarchical Outline

1. KMS Key Management
   • Key State Management
     • Enabled: Default state; key is available for use.
     • Disabled: Cryptographic operations fail; used to prevent access without deleting the key.
   • Automatic Rotation Management
     • Supported Keys: Only Symmetric Encryption KMS keys support automatic rotation.
     • Unsupported Keys: Asymmetric keys, HMAC keys, and keys with imported material do not support automatic rotation.
2. Rotation Strategies
   • AWS Managed: 365-day fixed schedule.
   • Customer Managed: Optional; must be manually enabled via Console, CLI, or API.
   • Manual Rotation: Creating a new KMS key and updating application code to use the new Key ID.

Visual Anchors

Automatic Rotation Logic

The Backing Key Relationship

Definition-Example Pairs

• Key Disabling: Moving a key from the "Enabled" state to "Disabled".
  • Example: You suspect an application's credentials have been leaked. You disable the Customer Managed Key immediately to stop all decryption of sensitive S3 buckets until the rotation and audit are complete.
• Rotation Enablement: Activating the automatic yearly update of backing material.
  • Example: For compliance (like PCI-DSS), you enable rotation on the key used for credit card data. AWS KMS handles the update every 365 days without you changing any application code.

Worked Examples

Enabling Rotation via AWS CLI

To enable automatic rotation for a specific customer-managed key, use the following command:

Disabling a Key via AWS CLI

If you want to stop all cryptographic operations for a key without deleting it (which is irreversible):

[!NOTE] After disabling a key, any attempt to use it (e.g., kms:Encrypt) will return a DisabledException.

Checkpoint Questions

1. True or False: You can disable automatic rotation for an AWS Managed Key used by Amazon S3.
2. Which key types support automatic rotation in KMS? (Symmetric, Asymmetric, or Both?)
3. What happens to data encrypted with an old backing key version after a rotation occurs?
4. If a key is in the "Disabled" state, will automatic rotation still occur if it was previously enabled?

▶Click to see answers

1. False. AWS Managed keys have mandatory, non-configurable rotation.
2. Symmetric keys only.
3. Nothing. KMS retains all old backing keys so it can automatically decrypt data that was encrypted with them.
4. No. Key rotation is suspended while a key is disabled.