feat(core): enable kms key rotation in bootstrap template #13466
Conversation
|
|
|
Title does not follow the guidelines of Conventional Commits. Please adjust title before merge. |
jaidisido
changed the title
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
njlynch
changed the title
|
I think this is reasonable, but tagging our resident bootstrap template expert, @rix0rrr , to ensure there's nothing here I'm missing. |
There was a problem hiding this comment.
Not entirely sure we want this on by default.
According to the documentation:
Rotating customer managed CMKs might result in extra monthly charges.
The price goes up by $1/month for every year that the bootstrap stack exists, and there seems to be no way to remove old key materials (so you can't even do anything about these costs).
For people that definitely know they want this and are prepared to pay the price, they can use customize the template for their own needs.
Enabling KMS key rotation is considered a security best practice.
AWS documentation: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license