LAB 28 ‐ Rotate keys in Vault - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

Rotate Keys in OCI Vault

What is Key Rotation?

In Oracle Cloud Infrastructure (OCI) Vault, Key Rotation means replacing the old encryption key version with a new key version while keeping the same master key.

Instead of creating a completely new key, OCI generates a new version of the existing key. Applications and services continue using the same key OCID, but encryption operations start using the latest key version automatically.

Key rotation improves security by reducing the risk of long-term exposure of encryption keys.

Why Rotate Keys?

Key rotation is an important security best practice because:

  • Reduces chances of key compromise
  • Helps meet compliance and security standards
  • Limits damage if an old key version is exposed
  • Improves overall encryption lifecycle management
  • Keeps sensitive data more secure over time

How OCI Key Rotation Works

When a key is rotated:

  1. OCI creates a new key version
  2. The latest version becomes active
  3. New encryption operations use the new version
  4. Previously encrypted data can still be decrypted using older key versions

This process happens without changing the application configuration.

Types of Key Rotation in OCI

1. Manual Key Rotation

In manual rotation, the administrator rotates the key whenever required using:

  • OCI Console
  • OCI CLI
  • API
  • SDK

Used When:

  • Organization follows custom security policies
  • Rotation needs approval before execution

2. Automatic Key Rotation

OCI can automatically rotate keys after a fixed schedule.

Example:

  • Every 30 days
  • Every 60 days
  • Every 90 days

Used When:

  • Organization wants continuous automated security
  • Compliance standards require regular rotation

OCI Services That Use Rotated Keys

Rotated keys can protect many OCI resources such as:

  • Block Volumes
  • Boot Volumes
  • Object Storage
  • Databases
  • File Storage
  • Kubernetes Secrets
  • Compute Instances

Benefits of Key Rotation

Benefit Description
Improved Security Reduces risk of long-term key exposure
Compliance Support Helps meet security regulations
Automatic Protection New encryption uses latest key version
No Service Downtime Rotation happens without affecting applications
Secure Data Lifecycle Maintains strong encryption management

Important Points About Key Rotation

  • Rotating a key does NOT delete old versions
  • Old encrypted data remains accessible
  • Same key OCID is maintained
  • Only key version changes
  • Applications usually do not require reconfiguration

Real-Time Example

Suppose a Block Volume is encrypted using a master key.

After rotating the key:

  • New data is encrypted using the latest key version
  • Existing encrypted data still works normally
  • OCI automatically manages old and new key versions

This allows secure encryption without interrupting services.

When to Rotate Keys?

Organizations commonly rotate keys:

  • Monthly
  • Quarterly
  • Annually
  • After security incidents
  • During compliance audits

Professional Use in Real Environments

OCI Key Rotation is professionally used for:

  • Enterprise security management
  • Financial applications
  • Healthcare systems
  • Government cloud environments
  • Compliance-driven infrastructures
  • Protecting sensitive production workloads

Conclusion

OCI Vault Key Rotation is a security feature that creates new versions of encryption keys to improve protection of sensitive data.

It helps organizations:

  • Maintain strong encryption security
  • Reduce risk exposure
  • Meet compliance standards
  • Secure OCI resources efficiently

Without changing applications or causing downtime, OCI automatically manages multiple key versions securely.

Steps to rotate keys in vault

  1. Open the key that you have created in your vault by selecting the right compartment and right vault.

Click on three dot option in right side of vault keys and select Rotate key option

Confirm the rotate key option

To view the key details

click on the option view key details by clicking on three dot in right side of vault keys

Now click on versions

In below screen you can see the versions of keys