AWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection control
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws configservice get-compliance-details-by-config-rule --config-rule-name cmk-backing-key-rotation-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name kms-cmk-not-scheduled-for-deletion --compliance-types NON_COMPLIANTExpected output
Two EvaluationResults arrays; empty NON_COMPLIANT sets mean automatic rotation is enabled on every eligible customer-managed CMK and no CMK protecting live data is pending deletion. Managed rule identifiers: CMK_BACKING_KEY_ROTATION_ENABLED, KMS_CMK_NOT_SCHEDULED_FOR_DELETION
Map — what it proves
- recipe1
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:SC 13/35 →
GovCloud
AWS Config and both managed rules are available in AWS GovCloud (US); KMS key ARNs use partition arn:aws-us-gov. GovCloud is served by FIPS 140-validated KMS endpoints by default
Notes & assertions
Rated partial: these rules prove key management (rotation, retention) as telemetry, but SC-13's core requirement — that the cryptographic module itself is FIPS 140-2/3 validated — is satisfied by using AWS KMS FIPS endpoints (kms-fips.<region>.amazonaws.com) and validated modules, which is a documented configuration/architecture assertion the compliance result does not itself carry. Attach the KMS FIPS endpoint usage evidence and the CMP module certificate reference alongside these results. Rotation is not supported for asymmetric/HMAC/imported-material/custom-key-store keys — scope the rotation rule accordingly.
References
- AWS Config managed rule: cmk-backing-key-rotation-enabled https://docs.aws.amazon.com/config/latest/developerguide/cmk-backing-key-rotation-enabled.html
- AWS Config managed rule: kms-cmk-not-scheduled-for-deletion https://docs.aws.amazon.com/config/latest/developerguide/kms-cmk-not-scheduled-for-deletion.html
- Data protection in AWS KMS — FIPS 140-3 validated HSMs and FIPS endpoints https://docs.aws.amazon.com/kms/latest/developerguide/data-protection.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Service Configuration run (10)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMScontinuousconfig-encryption-at-restAWS Config · Amazon S3 · Amazon EBS · Amazon RDS · AWS KMS
- partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSLcontinuousconfig-encryption-in-transitAWS Config · Amazon S3 · Elastic Load Balancing · Amazon Redshift
- partialAWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection controlyou are herecontinuousconfig-kms-key-managementAWS Config · AWS KMS
- partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than driftingcontinuousssm-configuration-baseline-enforcedAWS Config · AWS Systems Manager
- partialCryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evidentweeklyintegrity-verification-and-immutabilityAWS CloudTrail · AWS Config · Amazon S3 · AWS Backup · Amazon ECR
- partialDNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parentweeklyroute53-dnssec-signingAmazon Route 53 · AWS KMS
- partialPer-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absentweeklyroute53-resolver-dnssec-validationAmazon Route 53 · Amazon VPC
- partialEvery place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTPquarterlysession-authenticity-tls-terminationElastic Load Balancing · Amazon CloudFront · AWS Certificate Manager · AWS Config
- partialThe hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational statuscontinuousname-resolution-role-separationAmazon Route 53 · Amazon Route 53 Resolver
- partialWhether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.continuoussecret-exposure-detection-and-push-protectionGitHub secret scanning · GitHub code security configurations