KMS key last rotated timestamp

How to I get the KMS key last rotated time stamp using CLI

Topics

Tags

Language

English

asked a year ago618 views

1 Answer

Accepted Answer

I didn't think you could check the rotated timestamps in the AWS CLI.

I thought I could get it with "get-key-rotation-status", but the documentation does not provide timestamp information.
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/get-key-rotation-status.html

How about checking CloudTrail events instead?
The "RotateKey" event is recorded in CloudTrail, so you can check the time of execution from here. https://docs.aws.amazon.com/kms/latest/developerguide/ct-rotatekey.html

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RotateKey

EXPERT

answered a year ago

EXPERT

reviewed 2 months ago

rePost-User-6073944
a year ago
The cloudtrail command was the right direction, but the command you provided as an example gets all RotateKey events. What should I do if I want to get it for a particular key?
Riku_Kobayashi EXPERT
a year ago
If the ARN of the KMS key is known, it can be narrowed down by adding "--lookup-attributes" as follows. In the following command, replace "arn:aws:kms:region:AWS Account ID:key/Key ID" with the ARN of your KMS key.

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RotateKey AttributeKey=ResourceName,AttributeValue=arn:aws:kms:region:AWS Account ID:key/Key ID

a year ago

When I run this using boto3, it says

Unauthorised API call has been made :Region - us-east-1, Service - cloudtrail,Action - LookupEvents

Relevant content