Ensure Key Protect root keys have a rotation policy

MediumLevel 1Automatedibmcloud

Description

Rotation policies regularly re-wrap data encryption keys with new root key material. Every root (non-extractable) key in every Key Protect instance must have a rotation policy with interval_month (requires the kp plugin; keys are queried in the targeted region). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

How it is checked

Audit method: Shell command

shell

inst=$(ibmcloud resource service-instances --service-name kms --output json 2>/dev/null) || exit 1
bad=0
for g in $(printf '%s\n' "$inst" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"guid"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
  ks=$(ibmcloud kp keys -i "$g" --output json 2>/dev/null) || exit 1
  ids=$(printf '%s\n' "$ks" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 0 && o > 0 { id = ""; ex = "" } d == 1 && /"id"[[:space:]]*:/ { id = $0; sub(/^[^:]*:[[:space:]]*"/, "", id); sub(/".*/, "", id) } d == 1 && /"extractable"[[:space:]]*:/ { ex = $0 } { d += o - c } d == 0 && c > 0 && ex ~ /false/ { print id }')
  for k in $ids; do
    p=$(ibmcloud kp key policies "$k" -i "$g" --output json 2>/dev/null) || exit 1
    printf '%s\n' "$p" | grep -q '"interval_month"' || { echo "no rotation policy: $g $k"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

ibmcloud kp key policy-update rotation <key-id> -i <instance-id> --monthly-interval 12 (or shorter); alternatively set an instance-level rotation policy (ibmcloud kp instance policy-update rotation).

Properties

Operating systems: Any
Tags: ibmcloudkms
Reference: CIS IBM Cloud Foundations Benchmark v2.0.0 - Storage - Key Protect root key rotation (verify section number for your release)

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target ibmcloud