TMA-TDSQL-8.4
Ensure Encryption Key Rotation Is Configured
Beschreibung
Encryption master keys should be rotated periodically. TDSQL supports master key rotation via ALTER INSTANCE ROTATE INNODB MASTER KEY, which generates a new key version and re-wraps all data encryption keys (DEKs) using the envelope encryption model-without requiring data re-encryption. Assessed manually here: the benchmark check is environment-specific and cannot be evaluated reliably by a single command.
So wird geprüft
Prüfmethode: Manuelle Prüfung
Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.
Run SELECT * FROM performance_schema.keyring_keys ORDER BY KEY_ID DESC LIMIT 5; and SHOW GLOBAL STATUS LIKE 'Innodb_encryption_master_key_id'; then review KMS audit logs. The master key must have been rotated within the policy period (e.g. within the last 365 days); no rotation within the period is a finding.
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
1. Perform immediate key rotation: ALTER INSTANCE ROTATE INNODB MASTER KEY; 2. Verify rotation success: SHOW GLOBAL STATUS LIKE 'Innodb_encryption_master_key_id'; -- The key ID should increment after rotation 3. Establish a periodic rotation schedule (recommended: every 90-365 days) via operational procedures or automation.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- tdsqlencryption
- Referenz
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 8.4 Ensure Encryption Key Rotation Is Configured