Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Rotazione chiavi
La rotazione delle chiavi consiste nell'atto di modificare il materiale crittografico sottostante contenuto in una chiave di crittografia della chiave (KEK). Puoi attivarla automaticamente nell'ambito di una rotazione pianificata o manualmente, in genere dopo un incidente di sicurezza in cui le chiavi potrebbero essere state compromesse. La rotazione della chiave sostituisce solo il singolo campo della chiave contenente i dati non elaborati della chiave di crittografia/decrittografia.
Rotazione automatica delle chiavi
AWS Key Management Service (KMS) supporta la rotazione automatica delle chiavi KMS.
Se questa opzione è attivata, AWS genera automaticamente nuovo materiale per le chiavi di crittografia per la tua chiave una volta all'anno. Non sono richieste azioni manuali.
Dopo una rotazione della chiave, GKE su AWS cripta ogni nuovo segreto con la nuova chiave. Qualsiasi secret creato in precedenza viene ancora decriptato con la chiave originale.
Per questo motivo, AWS conserva il materiale della chiave precedente della CMK a tempo indeterminato, consentendo la decrittografia delle DEK precedenti quando vengono letti i vecchi secret.
Puoi vedere se la rotazione automatica è abilitata o meno per una chiave KMS con il seguente comando:
awskmsget-key-rotation--key-idKMS_KEY_ID
Sostituisci KMS_KEY_ID con l'ID chiave AWS KMS.
Puoi attivare la rotazione automatica delle chiavi eseguendo questo comando:
awskmsenable-key-rotation--key-idKMS_KEY_ID
Rotazione manuale delle chiavi
Questa sezione spiega come ruotare manualmente le chiavi di configurazione del control plane o del pool di nodi.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-07-14 UTC."],[],[],null,["# Rotate your cluster's security keys\n\nKey Rotation\n------------\n\nKey rotation is the act of changing the\nunderlying cryptographic material contained in a *key encryption key (KEK)*. It\ncan be triggered\nautomatically as part of a scheduled rotation, or\nmanually,\nusually after a security incident where keys might have been compromised. Key\nrotation replaces only the single field in the key that contains the raw\nencryption/decryption key data.\n\n### Automatic Key Rotation\n\nThe AWS Key Management Service (KMS) supports\n[automatic rotation of KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).\nWhen enabled, AWS automatically generates new cryptographic key material for\nyour key once a year. No manual actions are required.\n\nAfter a key rotation, GKE on AWS encrypts each new Secret with the\nnew key. Any previously-created Secret is still decrypted with its original key.\nFor this reason, AWS keeps CMK's older key material in perpetuity, allowing old\nDEKs to be decrypted when old Secrets are read.\n\nYou can see whether a KMS key has automatic rotation enabled or not with\nthe following command: \n\n aws kms get-key-rotation --key-id \u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e\n\nReplace \u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e with your AWS KMS key ID.\n\nYou can enable automatic key rotation by running this command: \n\n aws kms enable-key-rotation --key-id KMS_KEY_ID\n\n### Manual Key Rotation\n\nThis section explains how to manually rotate your control plane or node pool\nconfiguration keys.\n\n### Control plane configuration key\n\nTo manually rotate your\n[control plane configuration](/sdk/gcloud/reference/container/aws/clusters/create#--config-encryption-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n Save the value of your KMS key ARN. You'll use it later.\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Use the\n [`gcloud container aws clusters update`](/sdk/gcloud/reference/container/aws/clusters/update)\n command to update the encryption key.\n\n gcloud container aws clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --config-encryption-kms-key-arn=\u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the [supported Google Cloud region](/kubernetes-engine/multi-cloud/docs/aws/reference/supported-regions) that manages your cluster---for example, `us-west1`\n - \u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e: your new KMS key ARN\n\n### Control plane root volume\n\nTo manually rotate your\n[control plane root volume](/sdk/gcloud/reference/container/aws/clusters/create#--root-volume-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n Save the value of your KMS key ARN. You'll use it later.\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Use the\n [`gcloud container aws clusters update`](/sdk/gcloud/reference/container/aws/clusters/update)\n command to update the encryption key.\n\n gcloud container aws clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --root-volume-kms-key-arn=\u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the [supported Google Cloud region](/kubernetes-engine/multi-cloud/docs/aws/reference/supported-regions) that manages your cluster---for example, `us-west1`\n - \u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e: Amazon Resource Name (ARN) of the AWS KMS key to encrypt the root volume\n\n### Node pool configuration key\n\nTo manually rotate your\n[Node pool configuration](/sdk/gcloud/reference/container/aws/node-pools/create#--config-encryption-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Update the KMS alias in use:\n\n aws kms update-alias --alias-name \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e \\\n --target-key-id \u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e: your existing key's alias\n - \u003cvar translate=\"no\"\u003eCONFIG_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e: your new KMS key ARN\n4. Force the cluster to re-encrypt all cluster Secrets using the new\n encryption key:\n\n kubectl get secrets --all-namespaces -o json | \\\n kubectl annotate --overwrite -f - encryption-key-rotation-time=`date +\"%Y%m%d-%H%M%S\"`\n\n5. Disable the old AWS KMS key. For more information, see\n [Enabling and disabling keys](https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html).\n\n### Node pool root volumes\n\nTo manually rotate your\n[Node pool root volume](/sdk/gcloud/reference/container/aws/node-pools/create#--root-volume-kms-key-arn)\nkey, perform the following steps:\n\n1. [Create a new Cloud Key Management Service key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html).\n\n2. Ensure the IAM role associated with the cluster has permissions\n to encrypt and decrypt using the new key.\n\n3. Update the KMS alias in use:\n\n aws kms update-alias --alias-name \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e \\\n --target-key-id \u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEY_ALIAS\u003c/var\u003e: your existing key's alias\n - \u003cvar translate=\"no\"\u003eROOT_ENCRYPTION_KMS_KEY_ARN\u003c/var\u003e: your new KMS key ARN\n4. Update your node pool:\n\n gcloud container aws node-pools update \u003cvar translate=\"no\"\u003eNODE_POOL_NAME\u003c/var\u003e \\\n --root-volume-kms-key-arn=\u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNODE_POOL_NAME\u003c/var\u003e: name of your node pool\n - \u003cvar translate=\"no\"\u003eROOT_VOLUME_KMS_KEY_ARN\u003c/var\u003e: Amazon Resource Name (ARN) of the AWS KMS key to encrypt the root volume\n5. Disable the old AWS KMS key. For more information, see\n [Enabling and disabling keys](https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html)."]]
