Recommended policy for KMS controller does not include kms:EnableKeyRotation

[j3ffrw]

Describe the bug
The policy recommended in https://github.com/aws-controllers-k8s/kms-controller/blob/main/config/iam/recommended-inline-policy does not include kms:EnableKeyRotation causing the following error during creation of resource.

"error":"AccessDeniedException: User: arn:aws:sts::77777777777:assumed-role/ack-kms-202501100234234234243243234/234728374242842 is not authorized to perform: kms:EnableKeyRotation on resource: arn:aws:kms:us-west-2:777777777:key/aaaaaaa-bbbb-ccc-ddd-dfasfasdfse434 because no identity-based policy allows the kms:EnableKeyRotation action\n\tstatus code: 400, request id: 2342dsfsdf-fdef-4fe3-94e7-3w4wsfds8834"

Steps to reproduce

• Deploy ack-kms
• Deploy key crd

apiVersion: kms.services.k8s.aws/v1alpha1
kind: Key
metadata:
  name: samplekey
  namespace: db
spec:
  description: sample key for secretsmanager
  enableKeyRotation: true
  keySpec: SYMMETRIC_DEFAULT
  keyUsage: ENCRYPT_DECRYPT
  tags:
    - tagKey: Name
      tagValue: sampleykey

Expected outcome
Create key w/ auto key rotation enabled.

Actual result
a partially created key w/ autorotation setting disabled.

Environment
AWS

• Kubernetes version
• Using EKS (yes/no), if so version? EKS 1.30
• AWS service targeted (S3, RDS, etc.) KMS key

[rushmash91]

Hi @j3ffrw, Thank you for reporting the issue!

Would you be interested in contributing a fix for this? The change would be straightforward - we'd need to add the kms:EnableKeyRotation permission to the recommended inline policy in the config/iam/recommended-inline-policy file.