Managed key rotation

How managed key rotation works

When you rotate a managed key, new key material is automatically generated , the key is transitioned into the Active state and becomes available for cryptographic operations. The key IDs in keystores can also change, depending on the keystore type.

The following diagram shows a contextual view of the key rotation functionality.

Depending on the key type, managed keys in certain states are not eligible for key rotation. Before you rotate a managed key, make sure to check the following table. The Checkmark icon indicates that the managed key in this state is eligible for rotation. For more information about the different key states, see Monitoring the lifecycle of encryption keys in Unified Key Orchestrator.

Manage key rotation eligibility

Key type	Pre-active	Active	Deactivated	Destroyed
AWS Key Management Service keys	N/A			N/A
Azure Key Vault keys	N/A			N/A
Google Cloud KMS keys	N/A			N/A
IBM Cloud KMS keys	N/A		N/A	N/A
IBM Key Protect keys	N/A		N/A	N/A
z/OS keys

Impact of key template on key rotation

If your key naming scheme contains a system placeholder, the key cannot be rotated. In addition, the following rules apply:

In general, the name of your managed key will stay the same after managed key rotation. If your key instance naming scheme contains a system placeholder, the name of the new key will be updated according to this system placeholder. For example, imagine that you have a key template that specifies KEY.<environent> as key naming scheme and KEY.<environent>.<seqno> as key instance naming scheme. When you created your first key, you got prompted to specify the <environment> tag and specified TEST. Your managed key got created with the name of KEY.TEST. The name of the key in the keystore is KEY.TEST.00001. When you rotate this key, the new version's name of the managed key will remain KEY.TEST. In the keystore, the name of the new version will be KEY.TEST.00002 because the sequence number placeholder <seqno> got updated.

What happens to the previous key versions?

After key rotation, the service retains the previous key versions and materials until the managed key is deleted, but you can no longer edit these key materials and the key state might change. The following table lists the detailed changes and the corresponding actions that are available for previous key versions.

Available for protecting means that the following operations can be performed: encryption, wrapping, signing.

Available for processing means that the following operations can be performed: decryption, unwrapping, verification.

Previous key versions changes

Key type	Key state changes	Available for protecting	Available for processing	Description
AWS Key Management Service keys	Remain the same (default option) or changed to Deactivated state based on the key template properties			For more information, see Rotating AWS KMS keys.
Azure Key Vault keys	Remain the same (default option) or changed to Deactivated state based on the key template properties			For more information, see Configure cryptographic key auto-rotation in Azure Key Vault
Google Cloud KMS keys - Other key types except AES keys	Remain the same (default option) or changed to Deactivated state based on the key template properties			For more information, see Key rotation and Rotating keys.
Google Cloud KMS keys - AES keys	Remain the same (cannot be changed by the user)			For more information, see Key rotation and Rotating keys.
IBM Cloud KMS keys	Automatically move to Deactivated state (can not be changed by the user)			The previous key material can no longer be used for encryption, but it remains available for unwrap operations. When you use the rotated manage key to decrypt data, the service uses the same version of the key material that was used for encryption, and then rewraps data by using the latest key material.
IBM Key Protect keys	Automatically move to Deactivated state (can not be changed by the user)			The previous key material can no longer be used for encryption, but it remains available for unwrap operations. When you use the rotated manage key to decrypt data, the service uses the same version of the key material that was used for encryption before, and then rewraps data by using the latest key material. For more information, see Rotating your keys.
ICSF/CKDS PE keys	Remain the same (default option) or changed to Deactivated state based on the key template properties			The previous key remains in the keystore, maintaining its full capabilities. Be aware that the key can still expire. When a key expires, it can no longer be used in cryptographic operations. The expiration date must be changed to allow use of the key.

What's next

• For more information about how to manually rotate a managed key, see Rotating managed keys.
• For more information about how to edit managed keys, see Editing key details.