KMS keys should be rotated at least annually
Checks that KMS encryption keys are rotated within a set period. Checkov CKV_GCP_43 looks at `rotation_period` on `google_kms_crypto_key`. KICS says keys should be rotated every 90 days or less.
KMS encryption keys should be rotated every 90 days or less. A short lifetime of encryption keys reduces the potential blast radius in case of compromise.
What this control checks
google_kms_crypto_key needs a rotation_period of at most 90 days; a missing period fails.
Common pitfalls
Asymmetric keys return UNKNOWN
Automatic key rotation is not supported for asymmetric keys. The check returns CheckResult.UNKNOWN when purpose is ASYMMETRIC_DECRYPT or ASYMMETRIC_SIGN.
Missing rotation_period fails
The check evaluates rotation_period and returns CheckResult.FAILED when it is not set. A rotation_period is only accepted when it is between ONE_DAY and NINETY_DAYS.
Audit evidence
Evidence that deployed resources meet this control: Prowler check kms_key_rotation_enabled (prowler gcp --checks kms_key_rotation_enabled); PowerPipe controls gcp_compliance.control.cmek_rotation_one_hundred_days and gcp_compliance.control.kms_key_rotated_within_90_day.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_43; KICS query "High Google KMS Crypto Key Rotation Period" (d8c57c4e-bf6f-4e32-a2bf-8643532de77b).
Framework-specific interpretation
SOC 2: Mapped to PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.), 3.5.1.1 (Primary account number (PAN) is secured wherever it is stored.), 3.5.1.3 (Primary account number (PAN) is secured wherever it is stored.) and 10 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 11.4.2.c (protect access to system administration systems through authentication and encryption.), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...), 11.6.2.c (require the change of authentication credentials initially, at predefined intervals and upon suspicion that the...) and 8 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 3.6.1: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
8 more clauses
- 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- A.8.24 Use of cryptography
- 9 Cryptography
- 11 Access control
- 12 Asset management
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
1 more clause
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_kms_key_rotation_enabled - Checkov Check:
CKV_GCP_43 - Powerpipe Controls:
gcp_compliance.control.cmek_rotation_one_hundred_days,gcp_compliance.control.kms_key_rotated_within_90_day - Prowler Check:
kms_key_rotation_enabled - KICS Query:
d8c57c4e-bf6f-4e32-a2bf-8643532de77b
Last reviewed: 2026-10-09