Answers: <p>The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process.</p>
  
  <p>In this case you can likely have <a href="http://www.unixgeeks.org/security/newbie/unix/cron-1.html" rel="noreferrer">cron</a> run a bash script to read from a list of keys and credentials and then use the <a href="http://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html" rel="noreferrer">AWS kms cli</a> to "manually" change your keys.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-08-24T19:25:19.313Z
Answers: Has anyone done this successfully? And by 'successfully' I mean while keeping the data intact and accessible.
Answers: Signal15
Answers: CC BY-SA 3.0
Answers: 2017-03-02T14:05:39.577Z
Answers: 2017-03-11T14:59:07.770Z
Answers: 2017-03-11T14:59:07.770Z
Answers: avi
Body: <p>According AWS KMS, keys can be rotated once every year. However, there is no way I can define a custom time period for that.</p>
  
  <p>However, I can keep changing the same in the bucket's policy <strong>manually</strong>.</p>
  
  <p><strong>So, is there anyway I can automate that?</strong> </p>
  
Comments: CC BY-SA 3.0
Comments: 2017-03-01T10:07:40.720Z
Comments: Does using the cli to change the key not work?
Comments: avi
Comments: CC BY-SA 3.0
Comments: 2017-03-01T10:44:37.100Z
Comments: @avi It does. But, is there any way I can automate it?  [I know it's a noob doubt, but I'm new to backend :) ]
Comments: Dawny33
Tags: <automation><amazon-s3><amazon-kms>
Title: Is there any way I can rotate AWS KMS keys every time interval < 1 year?
UserDisplayName: Dawny33
ThreadText: # Is there any way I can rotate AWS KMS keys every time interval < 1 year?
  
  (Asked by: username_0 on 2017-03-01)
  
  According AWS KMS, keys can be rotated once every year. However, there is no way I can define a custom time period for that.
  
  However, I can keep changing the same in the bucket's policy **manually**.
  
  **So, is there anyway I can automate that?**
  
  **Tags:** automation, amazon-s3, amazon-kms
  
  > **Comments:**
  > **username_1**: Does using the cli to change the key not work?  
  > **username_0**: @username_1 It does. But, is there any way I can automate it?  [I know it's a noob doubt, but I'm new to backend :) ]  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-03-02. Score: 8 | Accepted answer
  
  The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process.
  
  In this case you can likely have [cron](http://www.unixgeeks.org/security/newbie/unix/cron-1.html) run a bash script to read from a list of keys and credentials and then use the [AWS kms cli](http://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html) to "manually" change your keys.
  
  > **Comments:**
  > **username_2**: Has anyone done this successfully? And by 'successfully' I mean while keeping the data intact and accessible.  
  
  ---
  
  