OCI Encryption KMS Keys Should Be Rotated At Least Once

Using Console

Below are the concise steps to remediate “OCI Encryption KMS Keys Should Be Rotated At Least Once” using the OCI Console.

1. Identify the Non‑Rotated Keys

Sign in to the OCI Console.
Go to Identity & Security → Vault.
Choose the Compartment you monitor (top-left compartment selector).
Open each Vault and then select Keys.
Look for Keys with:
- Key Status: Enabled
- No rotation history (never rotated) or last rotation is older than your required policy.

2. Manually Rotate a Key

For each key that needs rotation:

In the vault, go to Keys.
Click the Key Name you want to rotate.
On the key details page, click Rotate Key (or Create New Key Version).
Confirm the rotation:
- This creates a new key version; the key’s OCID stays the same.
- Existing resources using this key will automatically start using the new version (no change needed in resource config).
Verify rotation:
- On the key details page, you should now see multiple Key Versions with the latest marked as Primary.

3. Configure Automatic Key Rotation (Recommended)

To avoid future findings for “not rotated at least once”:

In the same Key details page, look for Key Rotation or Automatic Rotation section.
Click Edit Rotation Policy or Enable Rotation.
Set:
- Rotation Interval (e.g., every 90 days or per your policy).
Save.

This ensures:

The key is rotated at least once (clearing current misconfiguration).
Future rotations are automated, preventing recurring findings.

4. Confirm Remediation in Your Monitoring Tool

If you’re using OCI Cloud Guard / Security Zones / custom monitoring:

Allow some time for the next evaluation cycle.
Re-run the check (or wait for Cloud Guard detector to rescan).
Verify the finding for “OCI Encryption KMS Keys Should Be Rotated At Least Once” is no longer reported for keys you rotated.

If you share which exact monitoring/control (Cloud Guard detector recipe, Security Zone policy, or a third-party scanner), I can tailor the rotation interval and any additional verification steps to match that control’s logic.

Using CLI

Below are CLI-focused steps to rotate OCI KMS keys and (optionally) enforce a rotation schedule so they’re not flagged as “never rotated”.Assumptions:

You already have oci CLI configured with proper tenancy/region.
You know the vault-id and key-id for the keys in question.

1. Identify KMS keys that have never been rotated

List keys in a vault:

oci kms management key list \
  --compartment-id <compartment_ocid> \
  --vault-id <vault_ocid> \
  --all

For each key, list key versions:

oci kms management key-version list \
  --key-id <key_ocid> \
  --all

If only a single version exists (the original), the key has never been rotated.

2. Manually rotate a key (create a new key version)

Manual rotation = creating a new key version.

oci kms management key-version create \
  --key-id <key_ocid>

This immediately creates a new key version and makes it the primary version. Any subsequent cryptographic operations will use this new version, while old versions remain available for decrypting existing data (unless explicitly disabled/destroyed).You can verify:

oci kms management key-version list \
  --key-id <key_ocid> \
  --all

You should now see multiple versions.

3. Configure automatic key rotation (so the finding does not reoccur)

To ensure periodic rotation, you can set a rotation interval (policy) on the key.

3.1 Prepare a key policy JSON with rotation settings

Create a file key-policy.json:

{
  "keyPolicy": {
    "isUseKeyInVaultEnabled": true,
    "isDerivedKeysEnabled": true,
    "rotationInterval": "P90D"
  }
}

rotationInterval uses ISO 8601 duration format:
- P90D = every 90 days
- Example: P180D = every 180 days

Adjust flags (isUseKeyInVaultEnabled, isDerivedKeysEnabled) if needed for your environment.

3.2 Apply the key policy via OCI CLI

oci kms management key update \
  --key-id <key_ocid> \
  --from-json file://key-policy.json

Confirm:

oci kms management key get \
  --key-id <key_ocid>

Look for the keyPolicy and rotationInterval details in the output.

4. Scriptable remediation (optional)

To remediate all “never rotated” keys in a compartment:High-level bash pseudo-script:

COMPARTMENT_ID="<compartment_ocid>"
VAULT_ID="<vault_ocid>"

# List all keys in a vault
KEYS=$(oci kms management key list \
  --compartment-id "$COMPARTMENT_ID" \
  --vault-id "$VAULT_ID" \
  --query "data[].id" \
  --raw-output)

for KEY_ID in $KEYS; do
  VERSION_COUNT=$(oci kms management key-version list \
    --key-id "$KEY_ID" \
    --query "length(data)" \
    --raw-output)

  if [ "$VERSION_COUNT" -eq 1 ]; then
    echo "Rotating key: $KEY_ID"
    oci kms management key-version create --key-id "$KEY_ID"
    # Optionally enforce rotation policy
    oci kms management key update \
      --key-id "$KEY_ID" \
      --from-json file://key-policy.json
  fi
done

5. Tie into “OCI Encryption Monitoring”

To ensure any future non-rotated or long-unrotated keys are remediated:

Use Oracle Cloud Guard / Security Zones or your own governance scripts to:
- Periodically run a CLI/script similar to section 4 to:
  - Detect keys with a single version or last version older than your threshold.
  - Rotate them and/or enforce rotationInterval.
Optionally, configure an Events rule (e.g., on key creation) that triggers a Function which:
- Immediately sets the rotationInterval.
- Optionally performs an initial rotation.

In practice, for each flagged key:

oci kms management key-version create --key-id <key_ocid>
oci kms management key update --key-id <key_ocid> --from-json file://key-policy.json (with an appropriate rotationInterval).

Using Python

Below is how to remediate “OCI Encryption KMS Keys Should Be Rotated At Least Once” with Python-based monitoring and enforcement using the OCI Python SDK.

1. Prerequisites

Install SDK:

pip install oci

Configure OCI credentials (one of):

~/.oci/config with a profile (e.g. DEFAULT)
Or instance principal / resource principal (for OCI native execution)

Ensure the calling principal has these permissions in the compartment(s) and vault(s) you care about:

manage keys
read vaults

Example policy:

Allow group kms-admins to manage keys in compartment <your-compartment-name>
Allow group kms-admins to read vaults in compartment <your-compartment-name>

2. What you need to check

For each key:

Has at least one new key version been created (i.e., rotated) since creation?
Is automatic rotation enabled with a reasonable interval (e.g., 90 days)?

Key facts (OCI KMS):

Each rotation = new key version (create_key_version).
Automatic rotation is controlled via:
- is_auto_key_rotation_enabled
- rotation_interval_in_days (min 1 day, typical 30–365)

3. Python script: monitor and remediate rotation

This example:

Lists all vaults and keys in a compartment.
For each key, checks:
- Whether it has more than one version (i.e., rotated at least once).
- Whether auto-rotation is enabled with an acceptable interval.
Optionally:
- Enables auto-rotation if not enabled.
- Immediately rotates keys that have never been rotated.

Adjust: compartment OCID, rotation policy (e.g., 90 days), and DRY_RUN flag.

import oci
from datetime import datetime, timezone

# ------------------- CONFIG -------------------
CONFIG_PROFILE = "DEFAULT"
COMPARTMENT_OCID = "<your_compartment_ocid>"
DESIRED_ROTATION_INTERVAL_DAYS = 90  # your policy
DRY_RUN = False  # set to True to only report, False to remediate
# ----------------------------------------------

config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)

vault_client = oci.key_management.KmsManagementClient
kms_vault_client = oci.key_management.KmsVaultClient(config=config)
identity_client = oci.identity.IdentityClient(config=config)


def get_vaults_in_compartment(compartment_id):
    vaults = oci.pagination.list_call_get_all_results(
        kms_vault_client.list_vaults,
        compartment_id=compartment_id
    ).data
    return [v for v in vaults if v.lifecycle_state == "ACTIVE"]


def get_kms_management_client_for_vault(vault):
    crypto_endpoint = vault.management_endpoint
    # Use the same config but override service endpoint
    return vault_client(config=config, service_endpoint=crypto_endpoint)


def list_keys_in_vault(kms_mgmt_client, compartment_id):
    keys = oci.pagination.list_call_get_all_results(
        kms_mgmt_client.list_keys,
        compartment_id=compartment_id
    ).data
    return [k for k in keys if k.lifecycle_state == "ENABLED"]


def list_key_versions(kms_mgmt_client, key_id):
    versions = oci.pagination.list_call_get_all_results(
        kms_mgmt_client.list_key_versions,
        key_id=key_id
    ).data
    # Only enabled/primary are typically relevant
    return [v for v in versions if v.lifecycle_state in ("ENABLED", "PRIMARY")]


def ensure_auto_rotation(kms_mgmt_client, key):
    key_id = key.id
    needs_update = False

    is_auto = key.is_auto_key_rotation_enabled
    interval = key.rotation_interval_in_days

    if not is_auto:
        needs_update = True
        print(f"[AUTO-ROTATION] Key {key.display_name} ({key_id}) has auto-rotation DISABLED")
    elif interval is None or interval > DESIRED_ROTATION_INTERVAL_DAYS:
        needs_update = True
        print(f"[AUTO-ROTATION] Key {key.display_name} ({key_id}) interval is {interval}, "
              f"needs <= {DESIRED_ROTATION_INTERVAL_DAYS} days")

    if needs_update:
        if DRY_RUN:
            print(f"[DRY_RUN] Would enable/adjust auto-rotation for key {key.display_name}")
        else:
            update_details = oci.key_management.models.UpdateKeyDetails(
                is_auto_key_rotation_enabled=True,
                rotation_interval_in_days=DESIRED_ROTATION_INTERVAL_DAYS
            )
            kms_mgmt_client.update_key(key_id, update_details)
            print(f"[REMEDIATED] Auto-rotation enabled/set to {DESIRED_ROTATION_INTERVAL_DAYS} days for key {key.display_name}")
    else:
        print(f"[OK] Auto-rotation already enabled and compliant for key {key.display_name}")


def rotate_if_never_rotated(kms_mgmt_client, key, versions):
    key_id = key.id
    if len(versions) <= 1:
        # One version only (the original) => never rotated
        print(f"[ROTATION] Key {key.display_name} ({key_id}) has NEVER been rotated (only 1 version).")
        if DRY_RUN:
            print(f"[DRY_RUN] Would create a new key version (rotate) for key {key.display_name}")
        else:
            kms_mgmt_client.create_key_version(
                key_id=key_id,
                create_key_version_details=oci.key_management.models.CreateKeyVersionDetails()
            )
            print(f"[REMEDIATED] New key version created (manual rotation) for key {key.display_name}")
    else:
        print(f"[OK] Key {key.display_name} has {len(versions)} versions (rotated at least once).")


def main():
    print(f"Checking KMS key rotation in compartment: {COMPARTMENT_OCID}")
    vaults = get_vaults_in_compartment(COMPARTMENT_OCID)
    if not vaults:
        print("No active vaults found.")
        return

    for vault in vaults:
        print(f"\nVault: {vault.display_name} ({vault.id})")
        kms_mgmt_client = get_kms_management_client_for_vault(vault)
        keys = list_keys_in_vault(kms_mgmt_client, COMPARTMENT_OCID)

        if not keys:
            print("  No enabled keys in this vault.")
            continue

        for key in keys:
            print(f"\n  Key: {key.display_name} ({key.id})")
            # Refresh key to get latest metadata
            key = kms_mgmt_client.get_key(key.id).data

            # 1. Ensure at least one rotation has happened
            versions = list_key_versions(kms_mgmt_client, key.id)
            rotate_if_never_rotated(kms_mgmt_client, key, versions)

            # 2. Ensure auto-rotation is configured properly
            ensure_auto_rotation(kms_mgmt_client, key)


if __name__ == "__main__":
    main()

4. How this addresses the misconfiguration

Monitoring: Script reports keys that:
- Have never been rotated (only 1 key version).
- Do not have compliant auto-rotation settings.
Remediation (if DRY_RUN = False):
- Creates a new key version for never-rotated keys.
- Enables auto-rotation and sets rotation_interval_in_days to your policy.

5. Operationalizing

Run this script on a schedule (e.g., OCI Functions, OCI DevOps, or cron on a compute instance).
Send output to:
- OCI Logging / Object Storage / Email or Slack via webhooks for alerts.
Optionally:
- Restrict to “monitor only” in production (keep DRY_RUN=True) and have a change process for enabling actual rotation.

Using Terraform

# KMS vault this key belongs to (replace placeholders with your values)
resource "oci_kms_vault" "ENCRYPTION_VAULT" {
  compartment_id = "OCID_OF_COMPARTMENT"
  display_name   = "ENCRYPTION_VAULT_NAME"
  vault_type     = "DEFAULT" # or "VIRTUAL_PRIVATE"
}

# Existing KMS key which has never been rotated
resource "oci_kms_key" "ENCRYPTION_KEY" {
  management_endpoint = oci_kms_vault.ENCRYPTION_VAULT.management_endpoint
  compartment_id      = "OCID_OF_COMPARTMENT"
  display_name        = "ENCRYPTION_KEY_NAME"

  key_shape {
    algorithm = "AES"
    length    = 32
  }

  protection_mode = "HSM" # or "SOFTWARE"
}

# Rotation: create a new key version for the existing key (at least one rotation)
resource "oci_kms_key_version" "ENCRYPTION_KEY_ROTATION_1" {
  management_endpoint = oci_kms_vault.ENCRYPTION_VAULT.management_endpoint
  key_id              = oci_kms_key.ENCRYPTION_KEY.id
  # Optionally add lifecycle to prevent accidental destroy of this version
  lifecycle {
    prevent_destroy = true
  }
}

This adds a new key version for the existing OCI KMS key, satisfying the requirement that the key has been rotated at least once; it does not replace the key itself, so no outage is introduced.For verification, terraform plan should show a single + create action for oci_kms_key_version.ENCRYPTION_KEY_ROTATION_1 and no changes to oci_kms_key.ENCRYPTION_KEY.

OCI Misconfigurations

OCI Encryption KMS Keys Should Be Rotated At Least Once

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the Non‑Rotated Keys

2. Manually Rotate a Key

3. Configure Automatic Key Rotation (Recommended)

4. Confirm Remediation in Your Monitoring Tool

1. Identify KMS keys that have never been rotated

2. Manually rotate a key (create a new key version)

3. Configure automatic key rotation (so the finding does not reoccur)

3.1 Prepare a key policy JSON with rotation settings

3.2 Apply the key policy via OCI CLI

4. Scriptable remediation (optional)

5. Tie into “OCI Encryption Monitoring”

1. Prerequisites

2. What you need to check

3. Python script: monitor and remediate rotation

4. How this addresses the misconfiguration

5. Operationalizing

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Identify the Non‑Rotated Keys

​2. Manually Rotate a Key

​3. Configure Automatic Key Rotation (Recommended)

​4. Confirm Remediation in Your Monitoring Tool

​1. Identify KMS keys that have never been rotated

​2. Manually rotate a key (create a new key version)

​3. Configure automatic key rotation (so the finding does not reoccur)

​3.1 Prepare a key policy JSON with rotation settings

​3.2 Apply the key policy via OCI CLI

​4. Scriptable remediation (optional)

​5. Tie into “OCI Encryption Monitoring”

​1. Prerequisites

​2. What you need to check

​3. Python script: monitor and remediate rotation

​4. How this addresses the misconfiguration

​5. Operationalizing

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the Non‑Rotated Keys

2. Manually Rotate a Key

3. Configure Automatic Key Rotation (Recommended)

4. Confirm Remediation in Your Monitoring Tool

1. Identify KMS keys that have never been rotated

2. Manually rotate a key (create a new key version)

3. Configure automatic key rotation (so the finding does not reoccur)

3.1 Prepare a key policy JSON with rotation settings

3.2 Apply the key policy via OCI CLI

4. Scriptable remediation (optional)

5. Tie into “OCI Encryption Monitoring”

1. Prerequisites

2. What you need to check

3. Python script: monitor and remediate rotation

4. How this addresses the misconfiguration

5. Operationalizing