Skip to main content
PUT
Configure automatic key rotation
Primary IAM action: kms:EnableKeyRotation. When enabled is false, requires kms:DisableKeyRotation instead. Enabling or changing an enabled policy requires kms:EnableKeyRotation. See KMS permissions for policy examples.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

key_id
string<uuid>
required

Body

application/json
enabled
boolean
required
rotation_period_days
integer
default:365

Whole days between rotations. Omission selects 365 days.

Required range: 90 <= x <= 2560

Response

Success

rotation
object
required