Control: Ensure KMS encryption keys are rotated within a period of 90 days

Description

Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in ISO or RFC3339 format, and the rotation period must be in the form INTEGER[UNIT], where units can be one of seconds (s), minutes (m), hours (h) or days (d).

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.kms_key_rotated_within_90_day

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.kms_key_rotated_within_90_day --share

SQL

This control uses a named query:

select
  self_link as resource,
  case
    when "primary" ->> 'state' = 'DESTROYED' then 'skip'
    when "primary" ->> 'state' = 'DESTROY_SCHEDULED' then 'skip'
    when "primary" ->> 'state' = 'DISABLED' then 'skip'
    when split_part(rotation_period, 's', 1) :: int <= 7776000 then 'ok'
    else 'alarm'
  end as status,
  case
    when "primary" ->> 'state' = 'DESTROYED' then title || ' is destroyed.'
    when "primary" ->> 'state' = 'DESTROY_SCHEDULED' then title || ' is scheduled for deletion.'
    when "primary" ->> 'state' = 'DISABLED' then title || ' is disabled.'
    when rotation_period is null then title || ' in ' || key_ring_name || ' requires manual rotation.'
    else key_ring_name || ' ' || title || ' rotation period set for ' || (split_part(rotation_period, 's', 1) :: int)/86400 || ' day(s).'
  end as reason
  
  , location as location, project as project
from
  gcp_kms_key;

Control: Ensure KMS encryption keys are rotated within a period of 90 days

Description

Usage

SQL

Tags