Custom Key Rotation Solutions for AWS KMS

Rotating encryption keys on customer managed kms keys

#Solution Options

Regularly changing encryption keys is crucial for maintaining security and is a requirement from certain clients. This blog post discusses the solution options for rotating customer-managed encryption keys stored on Amazon-managed HSM stores. It does not address the rotation of KMS keys within customer-managed HSM stores or external key stores

AWS allows customers to rotate customer-managed keys once a year, while AWS automatically rotates AWS managed keys. However, AWS does not provide an option to rotate encryption data keys on a custom schedule, such as monthly or quarterly.

This blog post explores solution options for handling custom data key rotation on KMS.

#Solution 1: Rotating AWS generated encryption keys

Simple approach is to create a new KMS key at the required frequency, either monthly or quarterly, and assign the same alias to the newly created KMS key. In this option ,AWS handles the creation of encryption keys.

Design: Incorporate the logic for creating new KMS keys and assigning aliases to the new KMS keys within a Lambda function. EventBridge is utilised to schedule these Lambda functions at agreed-upon intervals. Upon the creation of new KMS keys, notifications should be sent to the required stakeholders to notify them that the key has been rotated.

#Solution 2: Rotating Customer generated encryption keys

Create a new KMS key without any key material, and then generate the encryption key externally, importing it into KMS. In this approach, the customer is responsible for generating the encryption data key and importing it into KMS.

AWS CLI and Open SSL commands generate new key and import key into kms:

Press enter or click to view image in full size

you can automate the solution using commands provided above in many ways based on the security requirements around the encryption keys

#Conclusion

In summary, we try to explore the solutions for rotating data encryption keys within customer-managed KMS, recognising that AWS offers limited opportunities to rotate these keys typically once per year .