Ensure Encryption Key Rotation Is Configured

MediumLevel 2Manual reviewtdsql

Description

Encryption master keys should be rotated periodically. TDSQL supports master key rotation via ALTER INSTANCE ROTATE INNODB MASTER KEY, which generates a new key version and re-wraps all data encryption keys (DEKs) using the envelope encryption model-without requiring data re-encryption. Assessed manually here: the benchmark check is environment-specific and cannot be evaluated reliably by a single command.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Run SELECT * FROM performance_schema.keyring_keys ORDER BY KEY_ID DESC LIMIT 5; and SHOW GLOBAL STATUS LIKE 'Innodb_encryption_master_key_id'; then review KMS audit logs. The master key must have been rotated within the policy period (e.g. within the last 365 days); no rotation within the period is a finding.

How it is fixed

Fix method: Guidance or infrastructure patch

1. Perform immediate key rotation: ALTER INSTANCE ROTATE INNODB MASTER KEY; 2. Verify rotation success: SHOW GLOBAL STATUS LIKE 'Innodb_encryption_master_key_id'; -- The key ID should increment after rotation 3. Establish a periodic rotation schedule (recommended: every 90-365 days) via operational procedures or automation.

Properties

Operating systems: Any
Tags: tdsqlencryption
Reference: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 8.4 Ensure Encryption Key Rotation Is Configured