Key lifecycle policies
Last updated
Last updated
Key lifecycle policies objective:
Control how often active encryption keys are rotated to reduce exposure and meet compliance requirements.
Control how long inactive keys and historical versions remain recoverable
Permanently destroy cryptographic keys after a defined grace period.
Set the key rotation interval.
Apply it to all existing keys.
Defines the recovery window for disabled keys and historical versions before permanent deletion.
Keys remain recoverable during the retention period and become eligible for scheduled destruction once expired.
Enables permanent deletion of cryptographic keys after a mandatory day grace period.
Ensures no immediate deletion, allowing keys to be recovered until the scheduled destruction date.
Dormant key detection automatically monitors key usage and classifies keys as idle or dormant when they have not been used within a defined period — helping you identify unused keys and take action before they become a security risk.
To configure, set the Idle threshold (number of inactive days before a key is marked idle) and the Dormant threshold (number of inactive days before a key is marked dormant). Dormant threshold must be greater than Idle threshold. Changes take effect on the next backend detection run.
