Find KMS Keys Without Automatic Rotation and Enable It

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListRegionsKeysAliases",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "kms:ListKeys",
        "kms:ListAliases"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadKeys",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:GetKeyRotationStatus"
      ],
      "Resource": "arn:aws:kms:*:111122223333:key/*"
    },
    {
      "Sid": "EnableRotationApplyOnly",
      "Effect": "Allow",
      "Action": "kms:EnableKeyRotation",
      "Resource": "arn:aws:kms:*:111122223333:key/*"
    }
  ]
}

// find-kms-keys-without-rotation.ts
// Lists customer managed KMS keys in each Region, reports which ones can rotate automatically and whether
// rotation is on, and explains why the others can't. Dry run by default: with --apply it calls
// EnableKeyRotation on enabled, rotatable keys whose rotation is off.
// Usage: npx tsx find-kms-keys-without-rotation.ts [--regions=us-east-1,eu-west-1] [--period=365] [--apply]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  KMSClient,
  paginateListKeys,
  paginateListAliases,
  DescribeKeyCommand,
  GetKeyRotationStatusCommand,
  EnableKeyRotationCommand,
  type KeyMetadata,
} from "@aws-sdk/client-kms";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const regionArg = args.find((a) => a.startsWith("--regions="))?.split("=")[1]?.split(",").map((s) => s.trim()).filter(Boolean);
const period = Number(args.find((a) => a.startsWith("--period="))?.split("=")[1] ?? "365");
if (!Number.isInteger(period) || period < 90 || period > 2560) {
  console.error("--period must be a whole number of days from 90 to 2560");
  process.exit(1);
}

type Status = "OFF" | "on" | "can't rotate" | "disabled" | "replica" | "error";
interface Row {
  Region: string;
  KeyId: string;
  Alias: string;
  Status: Status;
  PeriodDays: number | string;
  NextRotation: string;
  Note: string;
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg;
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

// Automatic rotation works only for symmetric encryption keys with KMS-generated key material
// outside custom key stores. Returns the reason a key can't rotate, or undefined if it can.
function cannotRotate(m: KeyMetadata): string | undefined {
  if (m.KeySpec !== "SYMMETRIC_DEFAULT") return `${m.KeySpec ?? "unknown"} key`;
  if (m.Origin === "EXTERNAL") return "imported key material";
  if (m.CustomKeyStoreId) return "custom key store";
  return undefined;
}

async function scanRegion(region: string): Promise<Row[]> {
  const kms = new KMSClient({ region });
  const aliases = new Map<string, string>();
  for await (const page of paginateListAliases({ client: kms }, {})) {
    for (const a of page.Aliases ?? []) {
      if (a.TargetKeyId && a.AliasName && !aliases.has(a.TargetKeyId)) aliases.set(a.TargetKeyId, a.AliasName);
    }
  }

  const rows: Row[] = [];
  for await (const page of paginateListKeys({ client: kms }, {})) {
    for (const k of page.Keys ?? []) {
      if (!k.KeyId) continue;
      const base = { Region: region, KeyId: k.KeyId, Alias: aliases.get(k.KeyId) ?? "-", PeriodDays: "-", NextRotation: "-" };
      try {
        const m = (await kms.send(new DescribeKeyCommand({ KeyId: k.KeyId }))).KeyMetadata;
        if (!m || m.KeyManager !== "CUSTOMER") continue; // AWS managed keys rotate every year on their own
        if (m.KeyState === "PendingDeletion" || m.KeyState === "PendingReplicaDeletion") continue;
        const reason = cannotRotate(m);
        if (reason) {
          rows.push({ ...base, Status: "can't rotate", Note: reason });
          continue;
        }
        if (m.MultiRegionConfiguration?.MultiRegionKeyType === "REPLICA") {
          const primary = m.MultiRegionConfiguration.PrimaryKey?.Region ?? "?";
          rows.push({ ...base, Status: "replica", Note: `set rotation on the primary key in ${primary}` });
          continue;
        }
        const r = await kms.send(new GetKeyRotationStatusCommand({ KeyId: k.KeyId }));
        const enabled = m.KeyState === "Enabled";
        rows.push({
          ...base,
          Status: r.KeyRotationEnabled ? "on" : enabled ? "OFF" : "disabled",
          PeriodDays: r.RotationPeriodInDays ?? "-",
          NextRotation: r.NextRotationDate ? r.NextRotationDate.toISOString().slice(0, 10) : "-",
          Note: enabled ? "" : `key state ${m.KeyState}; enable the key first`,
        });
      } catch (err) {
        rows.push({ ...base, Status: "error", Note: err instanceof Error ? err.name : String(err) });
      }
    }
  }

  if (apply) {
    for (const row of rows.filter((r) => r.Status === "OFF")) {
      try {
        await kms.send(new EnableKeyRotationCommand({ KeyId: row.KeyId, RotationPeriodInDays: period }));
        row.Status = "on";
        row.PeriodDays = period;
        row.Note = "rotation enabled now";
      } catch (err) {
        row.Note = `enable failed: ${err instanceof Error ? err.name : String(err)}`;
      }
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? err.name : String(err)}`);
    }
  }
  const order: Record<Status, number> = { OFF: 0, disabled: 1, error: 2, replica: 3, "can't rotate": 4, on: 5 };
  rows.sort((a, b) => order[a.Status] - order[b.Status] || a.Region.localeCompare(b.Region));
  console.table(rows);

  const off = rows.filter((r) => r.Status === "OFF").length;
  const on = rows.filter((r) => r.Status === "on").length;
  console.log(`${rows.length} customer managed key(s): ${on} rotating, ${off} rotatable but OFF.`);
  if (!apply && off) {
    console.log(`Dry run. Re-run with --apply to enable rotation every ${period} days on the ${off} OFF key(s).`);
    process.exitCode = 2;
  }
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-kms @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report every enabled Region (dry run)
AWS_PROFILE=security-audit npx tsx find-kms-keys-without-rotation.ts

# Turn rotation on, every 180 days, in two Regions
AWS_PROFILE=kms-admin npx tsx find-kms-keys-without-rotation.ts --regions=us-east-1,eu-west-1 --period=180 --apply

┌─────────┬─────────────┬────────────────────────────────────────┬─────────────────────┬────────────────┬────────────┬──────────────┬────────────────────────────────────────────────┐
│ (index) │ Region      │ KeyId                                  │ Alias               │ Status         │ PeriodDays │ NextRotation │ Note                                           │
├─────────┼─────────────┼────────────────────────────────────────┼─────────────────────┼────────────────┼────────────┼──────────────┼────────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ '0b1f9e2a-7c44-4d5e-9a61-3f2c8d7e1a90' │ 'alias/orders-db'   │ 'OFF'          │ '-'        │ '-'          │ ''                                             │
│ 1       │ 'us-east-1' │ '5d2c7a10-8e3b-4f6a-b1c9-2e7d4a8f6b35' │ 'alias/app-secrets' │ 'OFF'          │ '-'        │ '-'          │ ''                                             │
│ 2       │ 'us-east-1' │ 'e7a3c1d9-2b5f-4c8e-a6d0-9f1b3e5c7a24' │ 'alias/old-etl'     │ 'disabled'     │ '-'        │ '-'          │ 'key state Disabled; enable the key first'     │
│ 3       │ 'us-west-2' │ 'mrk-4c1e8a7b2d9f4e6c8a1b3d5f7e9c2a4b' │ 'alias/global-data' │ 'replica'      │ '-'        │ '-'          │ 'set rotation on the primary key in us-east-1' │
│ 4       │ 'us-east-1' │ '9c8e7d6f-5a4b-4c3d-8e2f-1a0b9c8d7e6f' │ 'alias/jwt-signing' │ "can't rotate" │ '-'        │ '-'          │ 'RSA_2048 key'                                 │
│ 5       │ 'us-east-1' │ '2a4c6e8f-1b3d-4f5a-9c7e-6d8f0a2c4e6b' │ 'alias/s3-logs'     │ 'on'           │ 365        │ '2027-02-11' │ ''                                             │
└─────────┴─────────────┴────────────────────────────────────────┴─────────────────────┴────────────────┴────────────┴──────────────┴────────────────────────────────────────────────┘
6 customer managed key(s): 1 rotating, 2 rotatable but OFF.
Dry run. Re-run with --apply to enable rotation every 365 days on the 2 OFF key(s).