Check ID:
Provider: GCP
Service:
Severity: LOW
Categories:
Resource type:
kms_key_rotation_enabledProvider: GCP
Service:
kmsSeverity: LOW
Categories:
encryptionResource type:
cloudkms.googleapis.com/CryptoKeyWhat this check verifies
Google Cloud KMS customer-managed keys have automatic rotation enabled or a rotation interval365 days.
The evaluation reviews each key’s rotation settings to confirm periodic creation of new key versions.
Risk
Without timely rotation, a stolen key can decrypt an expanding volume of data, eroding confidentiality. Prolonged key lifetimes widen windows for misuse, impact integrity of protected workloads, and make emergency rollover harder, risking availability disruptions.Recommendation
Enable auto-rotation for customer-managed keys with an interval365 days.
Adopt a key lifecycle policy: enforce least privilege on key usage, apply separation of duties between key admins and users, monitor key access, and rehearse emergency rotation to minimize blast radius.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudKMS/rotate-kms-encryption-keys.html
- https://cloud.google.com/iam/docs/manage-access-service-accounts
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = kms_key_rotation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks