Skip to content

Set the rotation policy and schedule

Choose the rules a key rotation must satisfy in your tenant, and how often the tenant's keys rotate automatically when they have no interval of their own.

Who can do it

A tenant administrator or a tenant key manager, once the platform super administrator has let the tenant change its policies. A platform super administrator can always do it.

The two parts are separate cards on the tenant's Policies screen:

  • Algorithm Rotation is a template: whether the new algorithm must serve the same operations, whether a weaker algorithm is refused, whether a key may move between classical and post-quantum algorithms, and which standards the target must meet.
  • Rotation schedule is the automatic-rotation interval the tenant's keys inherit.

Without the write permission a card is read-only. Without the delegation, Change template and Edit schedule are still offered, and the server refuses the change.

Before you start

  • The deployment has a rotation policy and a rotation schedule. A tenant interval can never be longer than the deployment maximum, and a template the deployment does not admit is refused.
  • A key with an interval of its own keeps it: the tenant schedule applies only to keys without one.

Steps

  1. Open Policies.
  2. To change the rotation rules:
    1. On the Algorithm Rotation card, select Change template.
    2. In Select Algorithm Rotation template, select a template card. Preview details shows its full content.
    3. Select Apply.
  3. To change the automatic-rotation interval:
    1. On the Rotation schedule card, select Edit schedule.
    2. Select Rotate automatically every, enter a whole number and choose the unit. Clear it to set no automatic interval for the tenant.
    3. Select Save.
  4. To give up the tenant's own policy, select Follow deployment policy on the card. On the Rotation schedule card, confirm with Follow deployment policy in the dialog.

A platform super administrator can also assign the rotation template from Platform Policies, in the Rotation column of Per-Tenant Policies.

What you see when it worked

  • A new template closes the dialog with Rotation policy updated, and the card names it.
  • A saved interval shows Rotation schedule saved. The card shows the Interval, the Source (Tenant default or Deployment default) and the version in effect since the save.
  • Following the deployment shows The tenant follows the deployment schedule again for the schedule, and names the deployment policy the tenant now follows for the template.

The rotation rules apply from the next rotation. The new interval applies to every key of the tenant that has no interval of its own.

When quorum approval gates rotation policy changes, nothing changes yet: the console shows Waiting for approval with a link to the request.

If it fails

What you see Cause What to do
You don't have permission to perform this action. The platform super administrator has not let the tenant change its policies, or you lack the permission Ask a platform super administrator to delegate the policy
Policy violates deployment subset on: … The template admits more than the deployment rotation policy Choose a narrower template
The interval is longer than the deployment maximum of … The deployment caps every schedule Choose a shorter interval
The interval is longer than the maximum cryptoperiod of … stated by the compliance packs … A compliance pack the tenant is entitled to limits the cryptoperiod Choose a shorter interval
The deployment is compliance-locked: an interval longer than its default of … is refused. The deployment is compliance-locked Choose an interval no longer than the deployment default
The interval is shorter than the shortest interval this deployment admits The interval is below the deployment's floor Choose a longer interval
The schedule changed since it was read. Someone else changed it meanwhile Review the current schedule and repeat your change

Without the console

Surface How
Key management CLI No command. ankasecure-km rotation replace-schedule sets one key's schedule, not the tenant's
Admin SDK Not available
API PUT /api/v3/admin/tenants/{tenantId}/policies/rotation with templateId (operation setRotationPolicy); DELETE /api/v3/admin/tenants/{tenantId}/policies/rotation (operation deleteRotationPolicy); PUT /api/v3/admin/tenants/{tenantId}/policies/rotation-schedule with triggers (operation replaceTenantRotationSchedulePolicy); DELETE /api/v3/admin/tenants/{tenantId}/policies/rotation-schedule (operation deleteTenantRotationSchedulePolicy)