[CDAP-21170] Enable Auto rotation of KMS keys used for secure keys

[adrikagupta]

To resolve a vulnerability, we need to enable auto rotation, for at most 90 days, of KMS keys which are used to encrypt/decrypt secure keys.

Changes made -

• Key rotation is enabled by default for all new keys in the keyring.
• Key rotation is enabled for existing keys in the keyring if not already enabled. This scenario will executed during upgrade.

Testing -

• Created an instance with the modified image and newly created kms keys had rotation enabled.
• Created an image with KMS keys not having rotation enabled. Upgrade the image to a version which uses modified image and rotation got enabled in existing kms keys.
• Created a MySQL -> Trash pipeline. Inside MySQL source plugin, added macro for secure key value in the password field. Successfully ran the pipeline. Manually rotated the key (the minimum rotation period is 24 hrs). After this, pipeline ran successfully.

[vsethi09]

LGTM

[sonarqubecloud]

Quality Gate failed

Failed conditions
65.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud