<p>The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process.</p>

<p>In this case you can likely have <a href="http://www.unixgeeks.org/security/newbie/unix/cron-1.html" rel="noreferrer">cron</a> run a bash script to read from a list of keys and credentials and then use the <a href="http://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html" rel="noreferrer">AWS kms cli</a> to "manually" change your keys.</p>

CC BY-SA 4.0
2018-08-24T19:25:19.313Z
Has anyone done this successfully? And by 'successfully' I mean while keeping the data intact and accessible.
Signal15
CC BY-SA 3.0
2017-03-02T14:05:39.577Z
2017-03-11T14:59:07.770Z
2017-03-11T14:59:07.770Z
avi
<p>According AWS KMS, keys can be rotated once every year. However, there is no way I can define a custom time period for that.</p>

<p>However, I can keep changing the same in the bucket's policy <strong>manually</strong>.</p>

<p><strong>So, is there anyway I can automate that?</strong> </p>

CC BY-SA 3.0
2017-03-01T10:07:40.720Z
Does using the cli to change the key not work?
avi
CC BY-SA 3.0
2017-03-01T10:44:37.100Z
@avi It does. But, is there any way I can automate it?  [I know it's a noob doubt, but I'm new to backend :) ]
Dawny33
<automation><amazon-s3><amazon-kms>
Is there any way I can rotate AWS KMS keys every time interval < 1 year?
Dawny33
# Is there any way I can rotate AWS KMS keys every time interval < 1 year?

(Asked by: username_0 on 2017-03-01)

According AWS KMS, keys can be rotated once every year. However, there is no way I can define a custom time period for that.

However, I can keep changing the same in the bucket's policy **manually**.

**So, is there anyway I can automate that?**

**Tags:** automation, amazon-s3, amazon-kms

> **Comments:**
> **username_1**: Does using the cli to change the key not work?  
> **username_0**: @username_1 It does. But, is there any way I can automate it?  [I know it's a noob doubt, but I'm new to backend :) ]  

---

## 1 answers

### Answer by username_1 on 2017-03-02. Score: 8 | Accepted answer

The AWS documentation is clear that automated key rotation is only supported by Amazon on a yearly basis. However, you can use the CLI to manually create new keys, and then use an automation technique such as cron to automate the manual process.

In this case you can likely have [cron](http://www.unixgeeks.org/security/newbie/unix/cron-1.html) run a bash script to read from a list of keys and credentials and then use the [AWS kms cli](http://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html) to "manually" change your keys.

> **Comments:**
> **username_2**: Has anyone done this successfully? And by 'successfully' I mean while keeping the data intact and accessible.  

---

