# AWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection control

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-kms-key-management

Recipe id: `config-kms-key-management` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-SIN`
- KSI `KSI-SVC-VRI`
- control `sc-13`

## Collection

Kind: `config-rule`

```sh
# cmk-backing-key-rotation-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name cmk-backing-key-rotation-enabled --compliance-types NON_COMPLIANT
# kms-cmk-not-scheduled-for-deletion
aws configservice get-compliance-details-by-config-rule --config-rule-name kms-cmk-not-scheduled-for-deletion --compliance-types NON_COMPLIANT
```

## Expected output

Two EvaluationResults arrays; empty NON_COMPLIANT sets mean automatic rotation is enabled on every eligible customer-managed CMK and no CMK protecting live data is pending deletion. Managed rule identifiers: CMK_BACKING_KEY_ROTATION_ENABLED, KMS_CMK_NOT_SCHEDULED_FOR_DELETION

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS Config and both managed rules are available in AWS GovCloud (US); KMS key ARNs use partition arn:aws-us-gov. GovCloud is served by FIPS 140-validated KMS endpoints by default

## Notes

Rated partial: these rules prove key management (rotation, retention) as telemetry, but SC-13's core requirement — that the cryptographic module itself is FIPS 140-2/3 validated — is satisfied by using AWS KMS FIPS endpoints (kms-fips.<region>.amazonaws.com) and validated modules, which is a documented configuration/architecture assertion the compliance result does not itself carry. Attach the KMS FIPS endpoint usage evidence and the CMP module certificate reference alongside these results. Rotation is not supported for asymmetric/HMAC/imported-material/custom-key-store keys — scope the rotation rule accordingly.

## References

- {"title":"AWS Config managed rule: cmk-backing-key-rotation-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/cmk-backing-key-rotation-enabled.html"}
- {"title":"AWS Config managed rule: kms-cmk-not-scheduled-for-deletion","url":"https://docs.aws.amazon.com/config/latest/developerguide/kms-cmk-not-scheduled-for-deletion.html"}
- {"title":"Data protection in AWS KMS — FIPS 140-3 validated HSMs and FIPS endpoints","url":"https://docs.aws.amazon.com/kms/latest/developerguide/data-protection.html"}