kms: support for key rotation period

[badmintoncryer]

Describe the feature

Configuring automatic key rotation period.

new kms.Key(this, 'MyKey', {
  enableKeyRotation: true,
  rotationPeriod: Duration.days(180), // Add
});

Use Case

Cloudformation supports for configuring period of automatic key rotation but CDK does not.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.127.0

Environment details (OS name and version, etc.)

irrelevant

[khushail]

@badmintoncryer , there is already a somewhat similar feature request in the past for enabling key rotation. See this -#22125. As mentioned in AWS Docs and suggested here in comments as well

AWS KMS charges a monthly fee for first and second rotation of key material maintained for your KMS key.

Please feel free to reach out if this one is different.

[badmintoncryer]

Thank you, @khushail, for the information. Issue #22125 discusses enabling key rotation feature that has already been implemented.

However, this issue pertains to configuring the rotation period, so I believe there is a distinction between the two.

[khushail]

Yes that's true , you are talking about rotation period. I might be wrong
but what I think the reason behind not keeping the rotation period was the same as well. By default this is false which means if user wants, and is aware of the billing, they can set it to true using the template or directly.

@pahud , wdyt?

[badmintoncryer]

@khushail
I also agree that key rotation should be disabled by default, and I understand that enabling it could incur charges.

This feature request is intended for users who do not mind the additional costs and want to perform key rotations. Currently, the only setting available is the default 365 days.

Therefore, even if key rotation is disabled by default, I believe there is still merit in implementing this feature.

Additionally, my understanding is that the discussion in issue #22125 revolves around the keys that are automatically generated at bootstrap. Indeed, it would be hard to accept if this setting incurs additional charges.

This time, we are considering an option for keys freely created by users. Wouldn't this be a different situation from the previous issue?

What are your thoughts about this?

[khushail]

@khushail I also agree that key rotation should be disabled by default, and I understand that enabling it could incur charges.

This feature request is intended for users who do not mind the additional costs and want to perform key rotations. Currently, the only setting available is the default 365 days.

Therefore, even if key rotation is disabled by default, I believe there is still merit in implementing this feature.

Additionally, my understanding is that the discussion in issue #22125 revolves around the keys that are automatically generated at bootstrap. Indeed, it would be hard to accept if this setting incurs additional charges.

This time, we are considering an option for keys freely created by users. Wouldn't this be a different situation from the previous issue?

What are your thoughts about this?

Hmmm, I understand your point of view in enabling this feature. Marking this as appropriate.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.