키 순환은 키 암호화 키(KEK)에 포함된 기본 암호화 자료를 변경하는 작업입니다. 예약된 순환에 따라 자동으로 또는 키가 손상되었을 수 있는 보안 사고가 발생한 후 수동으로 키 순환을 트리거할 수 있습니다. 키 순환을 수행하면 키에서 원시 암호화/복호화 키 데이터가 포함된 단일 필드만 바뀝니다.
자동 키 순환
AWS 키 관리 서비스(KMS)는 KMS 키의 자동 순환을 지원합니다.
사용 설정하면 AWS에서 키에 대한 새 암호화 키 자료를 1년에 한 번 자동으로 생성합니다. 직접 조치를 취할 필요는 없습니다.
키 순환 다음에는 AWS용 GKE가 새 키를 사용해서 새로운 보안 비밀을 암호화합니다. 이전에 생성된 보안 비밀은 여전히 원래 키를 사용하여 복호화됩니다.
따라서 AWS는 CMK의 이전 키 자료를 영구적으로 보관해서 이전 보안 비밀이 읽혀질 때 이전 DEK를 복호화할 수 있게 해줍니다.
다음 명령어를 사용해서 KMS 키의 자동 순환이 사용 설정되었는지 여부를 확인할 수 있습니다.
awskmsget-key-rotation--key-idKMS_KEY_ID
KMS_KEY_ID를 AWS KMS 키 ID로 바꿉니다.
다음 명령어를 실행하여 자동 키 순환을 사용 설정할 수 있습니다.
awskmsenable-key-rotation--key-idKMS_KEY_ID
수동 키 순환
이 섹션에서는 컨트롤 플레인 또는 노드 풀 구성 키를 수동으로 순환하는 방법을 설명합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-29(UTC)"],[],[],null,["# Rotate your cluster's security keys\n\nKey Rotation\n------------\n\nKey rotation is the act of changing the\nunderlying cryptographic material contained in a *key encryption key (KEK)*. It\ncan be triggered\nautomatically as part of a scheduled rotation, or\nmanually,\nusually after a security incident where keys might have been compromised. Key\nrotation replaces only the single field in the key that contains the raw\nencryption/decryption key data.\n\n### Automatic Key Rotation\n\nThe AWS Key Management Service (KMS) supports\n[automatic rotation of KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).\nWhen enabled, AWS automatically generates new cryptographic key material for\nyour key once a year. No manual actions are required.\n\nAfter a key rotation, GKE on AWS encrypts each new Secret with the\nnew key. Any previously-created Secret is still decrypted with its original key.\nFor this reason, AWS keeps CMK's older key material in perpetuity, allowing old\nDEKs to be decrypted when old Secrets are read.\n\nYou can see whether a KMS key has automatic rotation enabled or not with\nthe following command: \n\n aws kms get-key-rotation --key-id \u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e\n\nReplace \u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e with your AWS KMS key ID.\n\nYou can enable automatic key rotation by running this command: \n\n aws kms enable-key-rotation --key-id KMS_KEY_ID\n\n### Manual Key Rotation\n\nThis section explains how to manually rotate your control plane or node pool\nconfiguration keys.\n\n### Control plane configuration key\n\nTo manually rotate your\n[control plane configuration](/sdk/gcloud/reference/container/aws/clusters/create#--config-encryption-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n Save the value of your KMS key ARN. You'll use it later.\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Use the\n [`gcloud container aws clusters update`](/sdk/gcloud/reference/container/aws/clusters/update)\n command to update the encryption key.\n\n gcloud container aws clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --config-encryption-kms-key-arn=\u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the [supported Google Cloud region](/kubernetes-engine/multi-cloud/docs/aws/reference/supported-regions) that manages your cluster---for example, `us-west1`\n - \u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e: your new KMS key ARN\n\n### Control plane root volume\n\nTo manually rotate your\n[control plane root volume](/sdk/gcloud/reference/container/aws/clusters/create#--root-volume-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n Save the value of your KMS key ARN. You'll use it later.\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Use the\n [`gcloud container aws clusters update`](/sdk/gcloud/reference/container/aws/clusters/update)\n command to update the encryption key.\n\n gcloud container aws clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --root-volume-kms-key-arn=\u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the [supported Google Cloud region](/kubernetes-engine/multi-cloud/docs/aws/reference/supported-regions) that manages your cluster---for example, `us-west1`\n - \u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e: Amazon Resource Name (ARN) of the AWS KMS key to encrypt the root volume\n\n### Node pool configuration key\n\nTo manually rotate your\n[Node pool configuration](/sdk/gcloud/reference/container/aws/node-pools/create#--config-encryption-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Update the KMS alias in use:\n\n aws kms update-alias --alias-name \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e \\\n --target-key-id \u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e: your existing key's alias\n - \u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e: your new KMS key ARN\n4. Force the cluster to re-encrypt all cluster Secrets using the new\n encryption key:\n\n kubectl get secrets --all-namespaces -o json | \\\n kubectl annotate --overwrite -f - encryption-key-rotation-time=`date +\"%Y%m%d-%H%M%S\"`\n\n5. Disable the old AWS KMS key. For more information, see\n [Enabling and disabling keys](https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html).\n\n### Node pool root volumes\n\nTo manually rotate your\n[Node pool root volume](/sdk/gcloud/reference/container/aws/node-pools/create#--root-volume-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Update the KMS alias in use:\n\n aws kms update-alias --alias-name \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e \\\n --target-key-id \u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e: your existing key's alias\n - \u003cvar translate=\"no\"\u003eROOT_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e: your new KMS key ARN\n4. Update your node pool:\n\n gcloud container aws node-pools update \u003cvar translate=\"no\"\u003eNODE_POOL_NAME\u003c/var\u003e \\\n --root-volume-kms-key-arn=\u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNODE_POOL_NAME\u003c/var\u003e: name of your node pool\n - \u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e: Amazon Resource Name (ARN) of the AWS KMS key to encrypt the root volume\n5. Disable the old AWS KMS key. For more information, see\n [Enabling and disabling keys](https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html)."]]
