According AWS KMS, keys can be rotated once every year. However, there is no way I can define a custom time period for that.

However, I can keep changing the same in the bucket's policy manually.

So, is there anyway I can automate that?

  • Does using the cli to change the key not work?
    – avi
    Mar 1, 2017 at 10:07
  • @avi It does. But, is there any way I can automate it? [I know it's a noob doubt, but I'm new to backend :) ]
    – Dawny33
    Mar 1, 2017 at 10:44

1 Answer 1


The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process.

In this case you can likely have cron run a bash script to read from a list of keys and credentials and then use the AWS kms cli to "manually" change your keys.

  • Has anyone done this successfully? And by 'successfully' I mean while keeping the data intact and accessible.
    – Signal15
    Aug 24, 2018 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.