Login

Cloud Defense Logo

Products

Solutions

Company

Book A Live Demo

Rule: KMS CMK Rotation Should be Enabled

This rule ensures that Key Management Service Customer Managed Key rotation is enabled for security compliance.

RuleKMS CMK rotation should be enabled
FrameworkRBI Cyber Security Framework
Severity
✔
Critical

KMS CMK Rotation for RBI Cyber Security Framework

Rule Description

The Reserve Bank of India (RBI) Cyber Security Framework mandates that Key Management Service (KMS) Customer Master Keys (CMKs) should be rotated periodically. CMK rotation ensures that encryption keys used to protect sensitive data are regularly updated, reducing the risk of unauthorized access and potential security breaches.

Troubleshooting Steps

If you encounter any issues related to the KMS CMK rotation, you can follow these troubleshooting steps:

  2. 1.
    Check the rotation policy: Confirm if KMS CMK rotation is enabled and correctly configured according to the RBI Cyber Security Framework.
  4. 2.
    Review key rotation status: Verify the current rotation status of your CMKs using AWS CLI or AWS Management Console.
  6. 3.
    Examine any error messages: If there are any error messages, analyze them to identify the specific issue causing the rotation problem.
  8. 4.
    Verify permissions: Ensure that the user or role attempting to rotate CMKs has the necessary permissions to perform the rotation operation.
  10. 5.
    Review key policy: Check the key policy associated with your CMKs to ensure it allows the necessary actions for key rotation.
  12. 6.
    Review rotation policies: Review the overall KMS rotation policies and verify if there are any conflicts or misconfigurations.

Necessary Codes

If you need to implement KMS CMK rotation for RBI Cyber Security Framework, you can use the following AWS CLI command:

aws kms enable-key-rotation --key-id <your_key_id>

Replace 

<your_key_id>
with the actual ID of the CMK for which you want to enable rotation.

Step-by-Step Guide for Remediation

To enable KMS CMK rotation for RBI Cyber Security Framework, follow these step-by-step instructions:

  2. 1.
    Identify the CMK to be rotated: Determine the Customer Master Key (CMK) that needs to be rotated. You can either select an existing key or create a new one.
  4. 2.
    Ensure IAM permissions: Ensure that the IAM user or role you are using has the necessary permissions to enable CMK rotation. They should have the 
    kms:EnableKeyRotation
    permission.
  6. 3.
    Enable CMK rotation: Execute the following AWS CLI command to enable rotation for the chosen CMK:
aws kms enable-key-rotation --key-id <your_key_id>

Replace 

<your_key_id>
with the actual ID of the CMK you want to enable rotation for. 4. Verify rotation status: Run the following AWS CLI command to check the status of key rotation:

aws kms get-key-rotation-status --key-id <your_key_id>

Replace 

<your_key_id>
with the actual ID of the CMK you enabled rotation for. 5. Review and monitor rotation: Monitor the rotation process and verify that the CMK is being automatically rotated according to the predefined rotation schedule.

By following these steps, you will successfully enable KMS CMK rotation for RBI Cyber Security Framework and ensure that your encryption keys are regularly updated to meet the RBI's security requirements.

Is your System Free of Underlying Vulnerabilities?
Find Out Now