According AWS KMS, keys can be rotated once every year. However, there is no way I can define a custom time period for that.
However, I can keep changing the same in the bucket's policy manually.
So, is there anyway I can automate that?
-
Does using the cli to change the key not work?– aviCommented Mar 1, 2017 at 10:07
-
@avi It does. But, is there any way I can automate it? [I know it's a noob doubt, but I'm new to backend :) ]– Dawny33Commented Mar 1, 2017 at 10:44
Add a comment
|
1 Answer
The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process.
In this case you can likely have cron run a bash script to read from a list of keys and credentials and then use the AWS kms cli to "manually" change your keys.
-
Has anyone done this successfully? And by 'successfully' I mean while keeping the data intact and accessible.– Signal15Commented Aug 24, 2018 at 19:25