8
votes
Accepted
Is there any way I can rotate AWS KMS keys every time interval < 1 year?
The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique ...
- 1,279
2
votes
Accepted
Why does the datasource "external" always fail?
The command being run by the external provider here is equivalent to the following:
bash "export ENC_HOOK_URL=$(aws --profile ${AWS_PROFILE} \
kms encrypt --key-id ${KMS_ALIAS} --plaintext ${HOOK_URL}...
- 2,171
1
vote
Troubleshooting VPC flow logs with an S3 bucket using SSE-KMS encryption with CMK
Turns out I was missing one very important line in my KMS key policy:
resources = ["*"]
Now it works fine, and my full policy looks like this:
{
"Version": "2012-10-17",
"Statement": [
...
- 351
Only top scored, non community-wiki answers of a minimum length are eligible