1. Log in to your AWS Management Console.
2. Navigate to the AWS Key Management Service (KMS) dashboard.
3. Select the KMS key that needs to be remediated.
4. Click on the “Key policy” button to view the key policy.
5. In the key policy, locate the “KeyRotationEnabled” statement. If it is not present, add it to the key policy.
6. Set the value of “KeyRotationEnabled” to “true”.
7. Click on the “Save changes” button to save the updated key policy.

​

1. Open the AWS CLI on your local machine or in the AWS Management Console.
2. Check if the KMS key rotation is enabled or not using the following command:

aws kms get-key-rotation-status --key-id <key-id>

3. If the key rotation is not enabled, enable it using the following command:

aws kms enable-key-rotation --key-id <key-id>

4. Verify if the key rotation is enabled using the following command:

aws kms get-key-rotation-status --key-id <key-id>

5. Repeat steps 2-4 for all the KMS keys in your AWS account.

1. Import the necessary libraries:

import boto3

2. Create a boto3 client for AWS Key Management Service:

kms_client = boto3.client('kms')

3. Get a list of all KMS keys:

keys = kms_client.list_keys()

4. Loop through each key and check if key rotation is enabled:

for key in keys['Keys']:
    key_id = key['KeyId']
    key_rotation_status = kms_client.get_key_rotation_status(KeyId=key_id)
    if not key_rotation_status['KeyRotationEnabled']:
        # Enable key rotation
        kms_client.enable_key_rotation(KeyId=key_id)

5. Save the Python script and run it to enable key rotation for all KMS keys.

resource "aws_kms_key" "THIS_KMS_KEY" {
  description             = "KMS key for PURPOSE_DESCRIPTION"
  key_usage               = "ENCRYPT_DECRYPT"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"

  # Enable automatic yearly rotation (equivalent to
  # `aws kms enable-key-rotation --key-id ...`)
  enable_key_rotation = true

  # add any other required arguments you already use (policy, tags, etc.)
}

• THIS_KMS_KEY with your Terraform resource name.
• PURPOSE_DESCRIPTION with a description of the key’s use.

~ enable_key_rotation: false => true