Cloud KMS encryption keys should have rotation configured within 90 days

Cloud KMS encryption keys should be rotated within a period of 90 days. For the gcloud tool, the next rotation time must be in ISO or RFC3339 format. The rotation period must be in the form INTEGER[UNIT].

A short lifetime of encryption keys reduces the potential blast radius in case of compromise. Without timely rotation, a stolen key can decrypt an expanding volume of data, eroding confidentiality.

What this control checks

Checks that Cloud KMS encryption keys have rotation configured within 90 days

Common pitfalls

Asymmetric keys return UNKNOWN

Automatic key rotation is not supported for asymmetric keys. The check returns CheckResult.UNKNOWN when purpose is ASYMMETRIC_DECRYPT or ASYMMETRIC_SIGN.

Missing rotation_period fails

A google_kms_crypto_key with no rotation_period is flagged. A rotation_period of "77760009s" is also flagged.

Audit evidence

Evidence that deployed resources meet this control: Prowler check kms_key_rotation_max_90_days (prowler gcp --checks kms_key_rotation_max_90_days); PowerPipe control gcp_compliance.control.kms_key_rotated_within_90_day.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_43; KICS query "High Google KMS Crypto Key Rotation Period" (d8c57c4e-bf6f-4e32-a2bf-8643532de77b).

Framework-specific interpretation

SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).

NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management) and SC-28 (Protection Of Information At Rest).

NIST Cybersecurity Framework v2.0: Mapped to GV.RM-02 (Risk appetite and risk tolerance statements are established, communicated, and maintained.), GV.RM-03 (Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.), ID.AM-08 (Systems, hardware, software, services, and data are managed throughout their life cycles.) and 3 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

SOC 2

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

NIST SP 800-53 Rev 5

IA-5: Authenticator Management
SC-28 Protection Of Information At Rest

NIST Cybersecurity Framework v2.0

GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
ID.AM-08
PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
PR.AA-04

1 more clause