Control: 4.16 Ensure customer created Customer Managed Key (CMK) is rotated at least annually

Description

Oracle Cloud Infrastructure Vault securely stores master encryption keys that protect your your encrypted data. You can use the Vault service to rotate keys to generate new cryptographic material. Periodically rotating keys limits the amount of data encrypted by one key version.

Rotating keys annually limits the data encrypted under one key version. Key rotation thereby reduces the risk in case a key is ever compromised.

Remediation

From Console

1. Login to OCI Console.
2. Select Identity & Security from the Services menu.
3. Select Vault.
4. Click on the individual Vault under the Name heading.
5. Click on the menu next to the time created.
6. Click Rotate Key.

From CLI

1. Execute the following:

oci kms management key rotate --key-id <target_key_id> --endpoint <control_plane_url>