Check Details

• Entity Type: Integration
• Check: Enforce Kms Key Rotation
• Risk: KMS keys that are not rotated regularly increase the risk of key compromise and unauthorized data access.

Remediation via Google Cloud Console

1. Go to Key Management by visiting: Google Cloud Console .
2. Click on the specific key ring.
3. From the list of keys, choose the specific key and click on the right side pop-up blade (3 dots).
4. Click on Edit rotation period.
5. On the pop-up window, select a new rotation period in days which should be less than 90 and then choose Starting on date (date from which the rotation period begins).

Remediation via Google Cloud CLI

1. Open the Google Cloud Console and launch Cloud Shell.
2. Update and schedule rotation by ROTATION_PERIOD and NEXT_ROTATION_TIME for each key:

   
   
   gcloud kms keys update new \
   --keyring=KEY_RING \
   --location=LOCATION \
   --next-rotation-time=NEXT_ROTATION_TIME \
   --rotation-period=ROTATION_PERIOD
   
   

Default Value

By default, KMS encryption keys are rotated every 90 days.