KMS key should have automatic rotation enabled

What it checks

KMS key: automatic key rotation is not enabled.

Where it applies

Terraform: aws_kms_key

CloudFormation: AWS::KMS::Key

How to fix it

1. Set enable_key_rotation = true. AWS rotates the key material annually at no cost — existing ciphertext remains decryptable.

Frameworks

• AWS FSBP KMS.4
• SOC 2 CC6.1
• PCI-DSS v4.0.1/3.7.4
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules