Enabling Key Rotation

Keys that are widely or repeatedly used are insecure. To enhance the security of encryption keys, you are advised to periodically rotate keys and change their key materials.

The purposes of key rotation are:

• To reduce the amount of data encrypted by each key.

  Using a single key to encrypt large volumes of data compromises its security. Volume refers to the total number of bytes or messages encrypted using the same key.

• To enhance the capability of responding to security events.

  In your initial system security design, you shall design the key rotation function and use it for routine O&M, so that it will be at hand when an emergency occurs.

• To enhance the data isolation capability.

  The ciphertext data generated before and after key rotation will be isolated. You can identify the impact scope of a security event based on the key involved and take actions accordingly.

• To meet compliance requirements.

  Periodic key rotation helps organizations meet diverse regulatory and compliance requirements.

You can use either of the following key rotation methods:

• Manual key rotation

  Method 1: Create a key B to replace the currently used key A.

  Method 2: Modify the key A and use it.

  An example command is provided as follows:

  Take OBS as an example. To manually rotate a key, create a custom key on the KMS console. Replace the original custom key with the new one on the OBS console.

  Figure 1 Manual key rotation
  
• Automatic key rotation

  KMS automatically rotates keys based on the configured rotation period (365 days by default). The system automatically generates a new key to replace the key in use. Automatic key rotation only changes the key material of a CMK. The logical attributes of the key will not change, including its key ID, alias, description, and permissions.

  Automatic key rotation has the following characteristics:

  1. Enable rotation for an existing custom key. KMS will automatically generate new key materials for the custom key.
  2. Data is not re-encrypted in an automatic key rotation. The DEK generated using the CMK is not automatically rotated, and data that has been encrypted using the CMK will not be encrypted again. If a DEK has been leaked, automatic rotation cannot contain the impact of the leakage.
  Figure 2 Key rotation
  
  

  KMS retains all versions of a custom key, so that you can decrypt any ciphertext encrypted using the custom key.

  • KMS uses the latest version of the custom key to encrypt data.
  • When decrypting data, KMS uses the custom key version that was used to encrypt the data.

  The advantages and disadvantages of the two methods are as follows.

  Table 1 Advantages and disadvantages

  Feature	Manual Key Rotation	Automatic key rotation
  Flexibility	High. You can rotate keys at any time based on immediate operational needs.	Moderate. Rotation is scheduled based on a predefined rotation policy.
  Controllability	High. Administrators have direct, manual control over when a key is rotated.	Hands-off. The system manages rotation automatically according to your policy.
  Operation	Complex	Easy
  Security	Lower. It is prone to human error, oversight, or delayed rotations.	Higher. It minimizes the window of exposure for compromised keys through consistent rotation.

  In summary, automatic key rotation is ideal for large-scale or complex environments seeking robust security with minimal administrative overhead. Conversely, manual key rotation is better suited for specialized workflows that demand flexibility and precise control over the timing and conditions of a rotation. Select the method that best aligns with your security policies and operational resources. You can also combine both methods to maximize security while keeping management overhead low.