Customer-managed KMS key rotates within 365 days

Check ID: kms_key_rotation_enabled
Provider: Oracle Cloud (OCI)
Service: kms
Severity: HIGH
Categories: encryption
Resource type: Key

What this check verifies

OCI KMS customer-managed keys configured for automatic rotation, with a rotation interval set to <= 365 days, or manually rotated within the last 365 days. Some vault types do not support auto-rotation, so manual rotation is accepted as an alternative.

Risk

Without regular rotation, a compromised key can be used longer to decrypt data at rest and backups or to forge signatures. This erodes confidentiality and integrity, increases the blast radius, and complicates incident response due to broad reuse of the same key version.

Recommendation

Enable automatic key rotation and set an interval <= 365 days (shorter for sensitive data). For vault types that do not support auto-rotation (e.g., External or Virtual Private vaults), manually rotate the key at least once every 365 days. Apply least privilege and separation of duties for key administration. Monitor rotation status, retire old key versions, and ensure applications handle key versioning to prevent outages.

Remediation

CLI
Terraform
Dashboard steps

oci kms management key update --key-id <example_resource_id> --endpoint <example_management_endpoint> --is-auto-rotation-enabled true --auto-key-rotation-details '{"rotationIntervalInDays": 365}'

resource "oci_kms_key" "<example_resource_name>" {
  compartment_id      = "<example_resource_id>"
  display_name        = "<example_resource_name>"
  management_endpoint = "<example_management_endpoint>"

  key_shape {
    algorithm = "AES"
    length    = 16
  }

  is_auto_rotation_enabled = true  # Critical: enables auto rotation
  auto_key_rotation_details {
    rotation_interval_in_days = 365  # Critical: interval <= 365 days
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = kms_key_rotation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Integration Cloud instance restricts network access Default security list restricts all traffic but ICMP

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires