8

The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process. In this case you can likely have cron run a bash script to read from a list of keys and credentials and then use ...


2

The command being run by the external provider here is equivalent to the following: bash "export ENC_HOOK_URL=$(aws --profile ${AWS_PROFILE} \ kms encrypt --key-id ${KMS_ALIAS} --plaintext ${HOOK_URL} --output json \ --region ${AWS_REGION})" Bash is failing here because when used in this way it expects its first argument to be the filename of a script to ...


1

Turns out I was missing one very important line in my KMS key policy: resources = ["*"] Now it works fine, and my full policy looks like this: { "Version": "2012-10-17", "Statement": [ { "Sid": "Allow VPC Flow Logs to use the key", "Effect": "Allow", "Principal": { "Service": "...


Only top voted, non community-wiki answers of a minimum length are eligible