Customer-managed encryption keys should be rotated within 100 days
Evaluates customer-managed encryption keys (CMEK) in Cloud KMS and reports whether each key is rotated within 100 days. Each key receives its own result, so keys that exceed the 100 day rotation window can be identified individually.
Without timely rotation, a stolen key can decrypt an expanding volume of data, eroding confidentiality. Prolonged key lifetimes widen windows for misuse, impact integrity of protected workloads, and make emergency rollover harder, risking availability disruptions.
What this control checks
Customer-managed encryption keys must be rotated within 100 days
Common pitfalls
Asymmetric keys return UNKNOWN
Automatic key rotation is not supported for asymmetric keys. The check returns CheckResult.UNKNOWN when purpose is ASYMMETRIC_DECRYPT or ASYMMETRIC_SIGN.
Missing rotation_period fails
A google_kms_crypto_key with no rotation_period is flagged as a vulnerability.
Audit evidence
Evidence that deployed resources meet this control: Prowler check kms_key_rotation_max_90_days (prowler gcp --checks kms_key_rotation_max_90_days); PowerPipe controls gcp_compliance.control.cmek_rotation_one_hundred_days and gcp_compliance.control.kms_key_rotated_within_90_day.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_43; KICS query "High Google KMS Crypto Key Rotation Period" (d8c57c4e-bf6f-4e32-a2bf-8643532de77b).
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.RM-02 (Risk appetite and risk tolerance statements are established, communicated, and maintained.) and PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
- PR.DS-01
- 1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
- 1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
- 1.10 Ensure KMS encryption keys are rotated within a period of 90 days
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cmek_rotation_one_hundred_days - Checkov Check:
CKV_GCP_43 - Powerpipe Controls:
gcp_compliance.control.cmek_rotation_one_hundred_days,gcp_compliance.control.kms_key_rotated_within_90_day - Prowler Check:
kms_key_rotation_max_90_days - KICS Query:
d8c57c4e-bf6f-4e32-a2bf-8643532de77b
Last reviewed: 2026-10-09