Control: 3.16 Ensure customer created Customer Managed Key (CMK) is rotated at least annually

Description

Oracle Cloud Infrastructure Vault securely stores master encryption keys that protect your your encrypted data. You can use the Vault service to rotate keys to generate new cryptographic material. Periodically rotating keys limits the amount of data encrypted by one key version.

Remediation

From Console

1. Login to OCI Console.
2. Select Security from the Services menu.
3. Select Vault from the Security menu.
4. Click on the individual Vault under the Name heading.
5. Click on the menu next to the time created.
6. Click Rotate Key.

From Command Line

1. Execute the following:

oci kms management key rotate --key-id <target_key_id> --endpoint <control_plane_url>