Rotating KMS CMKs

To create new cryptographic material for your KMS CMKs, you can:
- Create new CMKs, and then change your applications or aliases to use the new CMKs.
- Enable automatic key rotation for an existing customer managed CMK.
When you enable automatic key rotation for a customer managed CMK, KMS generates new cryptographic material for the CMK every year.
KMS also saves the CMK's older cryptographic material in perpetuity so it can be used to decrypt data that it encrypted.
KMS does not delete any rotated key material until you delete the CMK.
Key rotation changes only the CMK's backing key, which is the cryptographic material that is used in encryption operations.
- The CMK is the same logical resource, regardless of whether or how many times its backing key changes:

Type of CMK?

Can manage CMK?

Used only for one AWS account?

Automatic rotation?

Customer managed CMK

Yes

Optional. Every 365 days (1 year).

AWS managed CMK

Yes

Required. Every 1095 days (3 years).

AWS owned CMK

Varies

How automatic key rotation works

KMS supports optional automatic key rotation only for customer managed CMKs.
Backing key management.
- KMS retains all backing keys for a CMK, even if key rotation is disabled.
- The backing keys are deleted only when the CMK is deleted.
- When you use a CMK to encrypt, KMS uses the current backing key.
- When you use the CMK to decrypt, KMS uses the backing key that was used to encrypt.
Enable and disable key rotation.
- Automatic key rotation is disabled by default on customer managed CMKs.
- When you enable key rotation, KMS automatically rotates the CMK 365 days after the enable date and every 365 days thereafter.
AWS managed CMKs.
- You cannot manage key rotation for AWS managed CMKs.
- KMS automatically rotates them every three years (1095 days).
AWS owned CMKs.
- You cannot manage key rotation for AWS owned CMKs.
- The key rotation strategy for an AWS owned CMK is determined by the AWS service that creates and manages the CMK.

You might want to create a new CMK and use it in place of a current CMK instead of enabling automatic key rotation.
The process of replacing one CMK with another is known as manual key rotation.

You might prefer to rotate keys manually so you can control the rotation frequency.
It's also a good solution for CMKs that are not eligible for automatic key rotation:
- Asymmetric CMKs.
- CMKs in custom key stores.
- CMKs with imported key material.

Last updated 4 years ago

Was this helpful?

How automatic key rotation works

KMS supports optional automatic key rotation only for customer managed CMKs.

Backing key management.

KMS retains all backing keys for a CMK, even if key rotation is disabled.
The backing keys are deleted only when the CMK is deleted.
When you use a CMK to encrypt, KMS uses the current backing key.
When you use the CMK to decrypt, KMS uses the backing key that was used to encrypt.

Enable and disable key rotation.

Automatic key rotation is disabled by default on customer managed CMKs.
When you enable key rotation, KMS automatically rotates the CMK 365 days after the enable date and every 365 days thereafter.

AWS managed CMKs.

AWS owned CMKs.

You cannot manage key rotation for AWS owned CMKs.
The key rotation strategy for an AWS owned CMK is determined by the AWS service that creates and manages the CMK.

Rotating keys manually

You might want to create a new CMK and use it in place of a current CMK instead of enabling automatic key rotation.

The process of replacing one CMK with another is known as manual key rotation.

You might prefer to rotate keys manually so you can control the rotation frequency.

It's also a good solution for CMKs that are not eligible for automatic key rotation: