Question
J.P. Morgan Services India PVT Ltd
IN
Last activity: 20 Aug 2025 9:50 EDT
key rotation in keystore using aws kms
Hi Team,
I am trying to understand key rotation in key store while source being amazon kms. does the number of days in cdk means in that that many days pega will automatically update the keys, or is there any manual operation involved after that many days.
I hav read the docs provided but still unclear https://docs.pega.com/bundle/platform/page/platform/security/configure-amazon-kms-key-rotation.html
HCA Healthcare
US
the days field in Pega’s KMS keystore is for the customer data key that Pega uses to encrypt your data, and Pega will rotate that data key automatically after that many days with no manual steps, as long as the keystore is set up correctly and the service account has GenerateDataKey and Decrypt permissions. This setting does not rotate your AWS KMS key itself. Rotation of the AWS KMS key material is a separate AWS setting that you enable in KMS, which by default rotates yearly and can now be set between 90 and 2560 days or triggered on demand. If you want both, set Pega’s CDK rotation interval in the keystore and also enable automatic rotation for the KMS key in AWS. Old data remains readable because AWS KMS keeps previous versions to decrypt while new encrypts use the fresh key material. Avoid external or custom key stores where AWS does not support automatic rotation. Monitor CloudTrail or CloudWatch to confirm KMS rotations and check Pega logs for successful CDK refresh events. Pega’s CDK interval is documented in their keystore setup guide, while AWS rotation behavior and periods are in the KMS docs.
J.P. Morgan Services India PVT Ltd
IN
@Sairohith Thanks, we want to rotate both keys under keystore as well the secrets stored in KMS.
For KMS we are exploring the AWS capabilities, but for keystore key values rotation is there an automatic way to do? or if we are dependent to update manually in the rule itself.
HCA Healthcare
US
if your keystore points to AWS KMS by ARN/alias, you don’t rotate anything in the Pega rule enable rotation on the KMS key in AWS and Pega keeps working because the alias stays the same. Pega’s “rotation interval (days)” only rotates the data-encryption key Pega generates via KMS; it happens automatically if the keystore is configured and the service account has GenerateDataKey/Decrypt. For secrets actually stored in AWS (KMS-encrypted values or AWS Secrets Manager), use AWS rotation (Secrets Manager + Lambda or KMS key rotation) and reference them by alias/ARN so no Pega change is needed. For keystores that embed static material in the rule (PEM/JKS, symmetric strings), Pega has no native auto-rotation—you must update the rule via a deployment pipeline or automation (Deployment Manager/prpcServiceUtils/REST). Consider moving those to an external source (AWS Secrets Manager or a JNDI keystore) so rotation is handled outside Pega. After any rotation, verify by exercising an encrypt/decrypt call and watch logs for KMS GenerateDataKey/Decrypt successes. In short: KMS/Secrets Manager = automatic (alias-based); static keystore content in Pega = manual or CI/CD automation.