OCI Encryption KMS Keys Should Be Rotated Every 90 Days

Using Console

Below are the steps to ensure OCI KMS keys are rotated every 90 days using the OCI Console (Vault service).

1. Navigate to the Vault and Keys

Sign in to the OCI Console.
In the left menu, go to:
Identity & Security → Vault.
Select the Compartment where your vault resides.
Click on the Vault that contains the KMS keys you want to rotate.

2. Enable / Configure Automatic Rotation to 90 Days

Inside the selected vault, go to the Keys tab.
Click on the Key you want to configure.
On the key details page, click Edit (or Edit Key / Edit Key Rotation, depending on UI version).
Find the Automatic Key Rotation (or Rotation Interval) section.
Set:
- Enable Automatic Rotation: ON
- Rotation Interval (days): enter 90
Click Save Changes (or Update).

Repeat this for every customer-managed key that must comply with the 90-day rotation requirement.

3. (Optional) Perform Immediate Manual Rotation

If a key is already older than 90 days and needs immediate rotation:

On the same Key Details page, click Create New Key Version (or Rotate Key Now).
Confirm rotation.
OCI creates a new key version and automatically starts using it for new encrypt operations.

4. Verify Configuration for Monitoring / Compliance

Go back to Identity & Security → Vault → [Your Vault] → Keys.
For each key:
- Confirm Automatic rotation is Enabled.
- Confirm Interval is set to 90 days.
If you use OCI Security Zones, Cloud Guard, or a 3rd-party CSPM:
- Trigger or wait for the next re-scan so that it picks up the new rotation setting and clears the “KMS Keys Should Be Rotated Every 90 Days” finding.

This configuration will satisfy the “OCI Encryption KMS Keys Should Be Rotated Every 90 Days” requirement using only the OCI Console.

Using CLI

In OCI, “rotating” a KMS key means creating a new key version. Apps keep using the same key OCID; OCI automatically uses the latest active version.Below is how to (1) monitor key age and (2) rotate keys older than 90 days using the OCI CLI.

1. Prerequisites

Install and configure OCI CLI:
oci setup config

Have the following:

Compartment OCID: ocid1.compartment.oc1...
Vault OCID: ocid1.vault.oc1... (optional filter)

IAM policy that lets your user/group manage keys:

Allow group <your-group> to manage keys in compartment <your-compartment-name>
Allow group <your-group> to use vaults in compartment <your-compartment-name>

Set some environment variables to simplify commands:

export COMPARTMENT_OCID="ocid1.compartment.oc1..xxxx"
export VAULT_OCID="ocid1.vault.oc1..xxxx"   # optional; remove filter if not needed

2. List Keys and Find Those Older Than 90 Days

Get all keys in the compartment (optionally filter by vault):

oci kms management key list \
  --compartment-id "$COMPARTMENT_OCID" \
  --vault-id "$VAULT_OCID" \
  --all \
  --output table

To get keys whose latest version is older than 90 days, use jq and some shell:

#!/usr/bin/env bash
set -euo pipefail

COMPARTMENT_OCID="ocid1.compartment.oc1..xxxx"
VAULT_OCID="ocid1.vault.oc1..xxxx"   # or leave empty and drop the option
DAYS=90

# Seconds threshold
THRESHOLD_SECONDS=$((DAYS * 24 * 60 * 60))
NOW_EPOCH=$(date -u +%s)

# List all keys
keys_json=$(oci kms management key list \
  --compartment-id "$COMPARTMENT_OCID" \
  --vault-id "$VAULT_OCID" \
  --all \
  --raw-output)

echo "$keys_json" | jq -r '.data[].id' | while read -r KEY_OCID; do
  # Get latest key version
  latest_version_json=$(oci kms management key-version list \
    --key-id "$KEY_OCID" \
    --sort-by TIME_CREATED \
    --sort-order DESC \
    --limit 1)

  CREATED_TIME=$(echo "$latest_version_json" | jq -r '.data[0]."time-created"')
  CREATED_EPOCH=$(date -u -d "$CREATED_TIME" +%s)
  AGE_SECONDS=$((NOW_EPOCH - CREATED_EPOCH))

  if [ "$AGE_SECONDS" -gt "$THRESHOLD_SECONDS" ]; then
    echo "Key $KEY_OCID has latest version older than $DAYS days (created: $CREATED_TIME)"
  fi
done

This prints keys that should be rotated.

3. Rotate a Key (Create New Version) via CLI

To rotate a single key:

export KEY_OCID="ocid1.key.oc1..xxxx"

oci kms management key-version create \
  --key-id "$KEY_OCID"

This creates a new key version.
OCI automatically uses the newest version for future crypto operations.
You typically do not need to change the key OCID in applications.

Verify versions:

oci kms management key-version list \
  --key-id "$KEY_OCID" \
  --all \
  --output table

4. Script: Automatically Rotate Keys Older Than 90 Days

You can combine monitoring and rotation:

#!/usr/bin/env bash
set -euo pipefail

COMPARTMENT_OCID="ocid1.compartment.oc1..xxxx"
VAULT_OCID="ocid1.vault.oc1..xxxx"   # or omit --vault-id usage if not needed
DAYS=90

THRESHOLD_SECONDS=$((DAYS * 24 * 60 * 60))
NOW_EPOCH=$(date -u +%s)

keys_json=$(oci kms management key list \
  --compartment-id "$COMPARTMENT_OCID" \
  --vault-id "$VAULT_OCID" \
  --all \
  --raw-output)

echo "$keys_json" | jq -r '.data[].id' | while read -r KEY_OCID; do
  latest_version_json=$(oci kms management key-version list \
    --key-id "$KEY_OCID" \
    --sort-by TIME_CREATED \
    --sort-order DESC \
    --limit 1)

  CREATED_TIME=$(echo "$latest_version_json" | jq -r '.data[0]."time-created"')
  CREATED_EPOCH=$(date -u -d "$CREATED_TIME" +%s)
  AGE_SECONDS=$((NOW_EPOCH - CREATED_EPOCH))

  if [ "$AGE_SECONDS" -gt "$THRESHOLD_SECONDS" ]; then
    echo "Rotating key $KEY_OCID (latest version created: $CREATED_TIME)..."
    oci kms management key-version create \
      --key-id "$KEY_OCID"
  else
    echo "Key $KEY_OCID is within $DAYS days; no rotation needed."
  fi
done

Run this script via a scheduled mechanism (cron, OCI Functions, or external scheduler) every day or week to enforce the “rotate every 90 days” requirement.

If you tell me your exact vault and compartment structure, I can tailor the CLI filters or the script to match your environment more precisely.

Using Python

Here’s how to enforce “KMS keys rotated every 90 days” in OCI using Python, by:

Enabling automatic rotation (preferred), or
Implementing your own monitoring + rotation script.

1. Prerequisites

Install the OCI Python SDK:
pip install oci
Configure OCI CLI/auth (SDK uses same config):
oci setup config
This creates ~/.oci/config with:
- tenancy
- user
- fingerprint
- key_file
- region

Ensure your user or instance principal has permissions:

Allow group <group-name> to manage keys in tenancy
Allow group <group-name> to read vaults in tenancy

2. Enabling Automatic Rotation Every 90 Days (Recommended)

If the policy is “every 90 days”, you can set automatic rotation on each key.

import oci

# Use config file; or use instance principals if running in OCI.
config = oci.config.from_file("~/.oci/config", "DEFAULT")

kms_management_client = oci.key_management.KmsManagementClient(config)

# If using a virtual/local service, you must set the endpoint for the vault’s management endpoint:
# kms_management_client.base_client.set_region("eu-frankfurt-1") # for example
# OR:
# kms_management_client.base_client.endpoint = "<vault_management_endpoint>"

def enable_auto_rotation_for_key(key_id: str, rotation_days: int = 90):
    """
    Enable automatic key rotation for a given KMS key.
    key_id: OCID of the key.
    rotation_days: number of days between rotations.
    """

    update_key_details = oci.key_management.models.UpdateKeyDetails(
        # Not changing name/description, only auto rotation
        auto_key_rotation_details=oci.key_management.models.AutoKeyRotationDetails(
            is_enabled=True,
            rotation_interval_in_days=rotation_days
        )
    )

    response = kms_management_client.update_key(
        key_id=key_id,
        update_key_details=update_key_details
    )
    return response.data

# Example usage:
key_ocid = "ocid1.key.oc1...."  # replace with your key OCID
updated_key = enable_auto_rotation_for_key(key_ocid, rotation_days=90)
print("Auto rotation enabled for key:", updated_key.id)

You can loop over all keys in a vault/tenancy and set this.

List all keys in a specific vault and enable rotation

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
kms_vault_client = oci.key_management.KmsVaultClient(config)

# If needed, set region
# kms_vault_client.base_client.set_region("eu-frankfurt-1")

kms_management_client = oci.key_management.KmsManagementClient(config)

def list_keys_in_vault(compartment_id: str, vault_id: str):
    """
    List all keys in a vault for a given compartment.
    """
    keys = []
    list_keys_response = kms_management_client.list_keys(
        compartment_id=compartment_id,
        limit=1000
    )
    keys.extend(list_keys_response.data)

    # Handle pagination
    while list_keys_response.has_next_page:
        list_keys_response = kms_management_client.list_keys(
            compartment_id=compartment_id,
            limit=1000,
            page=list_keys_response.next_page
        )
        keys.extend(list_keys_response.data)

    # Filter keys by vault (if needed)
    return [k for k in keys if k.vault_id == vault_id]

def enable_auto_rotation_all_keys_in_vault(compartment_id: str, vault_id: str, rotation_days: int = 90):
    keys = list_keys_in_vault(compartment_id, vault_id)
    for key in keys:
        print(f"Enabling auto rotation on key: {key.display_name} ({key.id})")
        update_key_details = oci.key_management.models.UpdateKeyDetails(
            auto_key_rotation_details=oci.key_management.models.AutoKeyRotationDetails(
                is_enabled=True,
                rotation_interval_in_days=rotation_days
            )
        )
        kms_management_client.update_key(
            key_id=key.id,
            update_key_details=update_key_details
        )

# Example usage:
compartment_ocid = "ocid1.compartment.oc1...."
vault_ocid       = "ocid1.vault.oc1...."
enable_auto_rotation_all_keys_in_vault(compartment_ocid, vault_ocid, rotation_days=90)

3. Monitoring + Manual Rotation (If Auto-Rotation Not Used/Supported)

You can implement a monitoring script that:

Lists keys.
Gets the creation time or last key version creation time.
If older than 90 days, calls create_key_version to rotate.

Helper: get age of latest key version

import datetime
from dateutil import tz  # pip install python-dateutil
import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
kms_management_client = oci.key_management.KmsManagementClient(config)

def get_latest_key_version_age_days(key_id: str) -> int:
    """
    Returns age in days of the latest key version.
    """
    versions = kms_management_client.list_key_versions(key_id=key_id).data
    if not versions:
        return 0

    latest_version = max(versions, key=lambda v: v.time_created)
    now = datetime.datetime.now(tz.UTC)
    age = (now - latest_version.time_created).days
    return age

Rotate if older than 90 days

def rotate_key_if_older_than(key_id: str, max_age_days: int = 90):
    age_days = get_latest_key_version_age_days(key_id)
    if age_days >= max_age_days:
        print(f"Rotating key {key_id}. Age: {age_days} days")
        kms_management_client.create_key_version(key_id=key_id)
        return True
    else:
        print(f"No rotation needed for {key_id}. Age: {age_days} days")
        return False

# Example:
key_ocid = "ocid1.key.oc1..."
rotate_key_if_older_than(key_ocid, max_age_days=90)

You can run this script daily via a scheduled job (e.g., OCI Functions + Service Connector / Events, or a cron job in a VM).

4. Basic “Monitoring” Output / Alerting

To align with “Encryption Monitoring”, you may simply:

Log which keys are:
- Not using auto-rotation, or
- Older than 90 days.
Export results to:
- OCI Logging
- Email via OCI Notifications
- Any SIEM

Example: print report of non-compliant keys:

def find_non_compliant_keys(compartment_id: str, vault_id: str, max_age_days: int = 90):
    non_compliant = []
    keys = list_keys_in_vault(compartment_id, vault_id)

    for key in keys:
        # Check auto rotation
        if key.auto_key_rotation_details and key.auto_key_rotation_details.is_enabled:
            if key.auto_key_rotation_details.rotation_interval_in_days <= max_age_days:
                continue  # compliant

        # Otherwise check last key version age
        age_days = get_latest_key_version_age_days(key.id)
        if age_days > max_age_days:
            non_compliant.append((key, age_days))

    return non_compliant

# Usage:
non_compliant = find_non_compliant_keys(compartment_ocid, vault_ocid, max_age_days=90)
for key, age in non_compliant:
    print(f"NON-COMPLIANT: {key.display_name} ({key.id}) - age {age} days")

Then you can wire this into:

OCI Notifications (publish message)
Email/slack via separate process.

If you tell me how you’re currently running “OCI Encryption Monitoring” (function, VM, CI job, etc.), I can adapt this into a single ready-to-run script for that environment.

Using Terraform

Terraform for the oci_kms_key resource does not expose any argument to configure automatic rotation or a rotation interval, so this finding cannot be remediated purely via Terraform; configure key rotation in the OCI Console (Vault → Keys → select key → Enable/Configure Auto Rotation) or via scheduled OCI CLI/SDK automation instead.

# NOTE: OCI KMS key rotation interval (e.g., every 90 days) is not configurable
# via the oci_kms_key Terraform resource as of the current provider version.
# Use the OCI Console or an external scheduler + CLI/SDK to rotate keys.

resource "oci_kms_key" "EXAMPLE_KEY" {
  # Replace with your values
  compartment_id     = "OCID_OF_COMPARTMENT"
  management_endpoint = "https://KMS_ENDPOINT"
  display_name        = "EXAMPLE_KEY_NAME"

  key_shape {
    algorithm = "AES"
    length    = 32
  }
}

Verification in Terraform: terraform plan will not show any field related to rotation interval or automatic rotation for oci_kms_key; rotation must be verified in the OCI Console under the key’s rotation settings.

OCI Misconfigurations

OCI Encryption KMS Keys Should Be Rotated Every 90 Days

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Navigate to the Vault and Keys

2. Enable / Configure Automatic Rotation to 90 Days

3. (Optional) Perform Immediate Manual Rotation

4. Verify Configuration for Monitoring / Compliance

1. Prerequisites

2. List Keys and Find Those Older Than 90 Days

3. Rotate a Key (Create New Version) via CLI

4. Script: Automatically Rotate Keys Older Than 90 Days

1. Prerequisites

2. Enabling Automatic Rotation Every 90 Days (Recommended)

List all keys in a specific vault and enable rotation

3. Monitoring + Manual Rotation (If Auto-Rotation Not Used/Supported)

Helper: get age of latest key version

Rotate if older than 90 days

4. Basic “Monitoring” Output / Alerting

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Navigate to the Vault and Keys

​2. Enable / Configure Automatic Rotation to 90 Days

​3. (Optional) Perform Immediate Manual Rotation

​4. Verify Configuration for Monitoring / Compliance

​1. Prerequisites

​2. List Keys and Find Those Older Than 90 Days

​3. Rotate a Key (Create New Version) via CLI

​4. Script: Automatically Rotate Keys Older Than 90 Days

​1. Prerequisites

​2. Enabling Automatic Rotation Every 90 Days (Recommended)

​List all keys in a specific vault and enable rotation

​3. Monitoring + Manual Rotation (If Auto-Rotation Not Used/Supported)

​Helper: get age of latest key version

​Rotate if older than 90 days

​4. Basic “Monitoring” Output / Alerting

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Navigate to the Vault and Keys

2. Enable / Configure Automatic Rotation to 90 Days

3. (Optional) Perform Immediate Manual Rotation

4. Verify Configuration for Monitoring / Compliance

1. Prerequisites

2. List Keys and Find Those Older Than 90 Days

3. Rotate a Key (Create New Version) via CLI

4. Script: Automatically Rotate Keys Older Than 90 Days

1. Prerequisites

2. Enabling Automatic Rotation Every 90 Days (Recommended)

List all keys in a specific vault and enable rotation

3. Monitoring + Manual Rotation (If Auto-Rotation Not Used/Supported)

Helper: get age of latest key version

Rotate if older than 90 days

4. Basic “Monitoring” Output / Alerting