--- name: key-management-orchestrator-4a7a5cee3094 description: Cryptographic key lifecycle management orchestration including generation, rotation, and destruction across key management systems allowed-tools: - Bash - Read - Write - Glob - Grep - WebFetch graph: domains: [domain:security] specializations: [specialization:security-compliance] skillAreas: [skill-area:secrets-rotation, skill-area:encryption-decryption] roles: [role:security-engineer, role:privacy-engineer] workflows: [workflow:security-audit] topics: [topic:ssl-certs] --- # Key Management Orchestrator Skill ## Purpose Orchestrate cryptographic key lifecycle management across key management systems, including key generation, distribution, rotation, destruction, and compliance monitoring. ## Capabilities ### Key Generation - Generate cryptographic keys with proper entropy - Create keys with appropriate algorithms and sizes - Generate keys within HSM boundaries - Create key pairs for asymmetric operations - Generate derived keys using approved KDFs - Document key generation metadata ### Key Rotation Management - Define and enforce rotation policies - Schedule automatic key rotations - Execute zero-downtime rotations - Coordinate multi-system rotations - Maintain key version history - Handle rotation rollbacks ### Key Usage Tracking - Monitor key usage patterns - Track encryption/decryption operations - Identify unused or orphaned keys - Detect anomalous usage patterns - Measure key usage against policies - Generate usage audit reports ### Key Destruction - Execute secure key destruction - Verify destruction completeness - Document destruction certificates - Handle key material in backups - Manage crypto-shredding operations - Maintain destruction audit trails ### HSM Integration - Interface with hardware security modules - Manage HSM key hierarchies - Handle HSM backup and recovery - Monitor HSM health and capacity - Coordinate multi-HSM deployments - Validate FIPS compliance ### Key Operations Auditing - Log all key lifecycle events - Generate compliance audit reports - Track key custodian changes - Document key ceremonies - Monitor policy violations - Support forensic investigations ## Key Types Managed | Key Type | Use Case | Rotation Period | |----------|----------|-----------------| | Master Keys | Key encryption keys | Annual | | Data Keys | Data encryption | Monthly | | Signing Keys | Code/document signing | Annual | | TLS Keys | Transport security | Annual | | API Keys | Service authentication | 90 days | | Session Keys | Ephemeral encryption | Per-session | ## Key Lifecycle Stages 1. **Generation**: Secure key creation with proper entropy 2. **Distribution**: Secure key transport to authorized systems 3. **Activation**: Key enabled for cryptographic operations 4. **Use**: Active cryptographic operations 5. **Rotation**: Scheduled key replacement 6. **Deactivation**: Key disabled but retained 7. **Destruction**: Secure permanent deletion ## Integrations - **HashiCorp Vault**: Secrets and key management - **AWS KMS**: Cloud key management service - **Azure Key Vault**: Microsoft key management - **GCP Cloud KMS**: Google key management - **Thales Luna HSM**: Hardware security modules - **AWS CloudHSM**: Cloud-based HSM ## Target Processes - Cryptography and Key Management Process - Secrets Management - Certificate Lifecycle Management - Data Encryption Key Management ## Input Schema ```json { "type": "object", "properties": { "operation": { "type": "string", "enum": ["generate", "rotate", "destroy", "audit", "policy-check", "inventory"], "description": "Key management operation" }, "keyType": { "type": "string", "enum": ["master", "data", "signing", "tls", "api", "session"], "description": "Type of cryptographic key" }, "algorithm": { "type": "string", "enum": ["AES-256", "RSA-2048", "RSA-4096", "ECDSA-P256", "ECDSA-P384", "Ed25519"], "description": "Cryptographic algorithm" }, "keyManagementSystem": { "type": "string", "enum": ["vault", "aws-kms", "azure-keyvault", "gcp-kms", "hsm"], "description": "Target key management system" }, "keyId": { "type": "string", "description": "Key identifier for operations on existing keys" }, "rotationPolicy": { "type": "object", "properties": { "maxAge": { "type": "string" }, "autoRotate": { "type": "boolean" }, "notifyBefore": { "type": "string" } } }, "destructionVerification": { "type": "boolean", "description": "Require destruction verification" }, "complianceFrameworks": { "type": "array", "items": { "type": "string", "enum": ["NIST", "FIPS-140-3", "PCI-DSS", "HIPAA", "SOC2"] } } }, "required": ["operation"] } ``` ## Output Schema ```json { "type": "object", "properties": { "operationId": { "type": "string" }, "operation": { "type": "string" }, "timestamp": { "type": "string", "format": "date-time" }, "keyInfo": { "type": "object", "properties": { "keyId": { "type": "string" }, "keyType": { "type": "string" }, "algorithm": { "type": "string" }, "keySize": { "type": "integer" }, "createdAt": { "type": "string" }, "expiresAt": { "type": "string" }, "version": { "type": "integer" }, "status": { "type": "string", "enum": ["active", "inactive", "pending-destruction", "destroyed"] } } }, "rotationStatus": { "type": "object", "properties": { "previousVersion": { "type": "integer" }, "newVersion": { "type": "integer" }, "rotatedAt": { "type": "string" }, "affectedSystems": { "type": "array" }, "rollbackAvailable": { "type": "boolean" } } }, "destructionCertificate": { "type": "object", "properties": { "keyId": { "type": "string" }, "destroyedAt": { "type": "string" }, "method": { "type": "string" }, "verificationHash": { "type": "string" }, "witness": { "type": "string" } } }, "auditReport": { "type": "object", "properties": { "period": { "type": "object" }, "keysInventoried": { "type": "integer" }, "rotationsCompleted": { "type": "integer" }, "policyViolations": { "type": "integer" }, "unusedKeys": { "type": "array" }, "expiringKeys": { "type": "array" } } }, "complianceStatus": { "type": "object", "properties": { "framework": { "type": "string" }, "compliant": { "type": "boolean" }, "findings": { "type": "array" } } }, "recommendations": { "type": "array", "items": { "type": "string" } } } } ``` ## Usage Example ```javascript skill: { name: 'key-management-orchestrator', context: { operation: 'rotate', keyType: 'data', keyManagementSystem: 'vault', keyId: 'prod-encryption-key', rotationPolicy: { maxAge: '90d', autoRotate: true, notifyBefore: '7d' } } } ``` --- Source attribution: a5c-ai Original project: https://github.com/a5c-ai/babysitter License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 Gabriel Moreira Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: a5c-ai Original project: https://github.com/a5c-ai/babysitter Attribution basis: Upstream repository explicitly recorded in package mirror path Fields of work: Development & Engineering Roles: Data Engineer, DevOps / SRE, Security Engineer Specialties: Specialty not specified Tools: AWS, Azure, GCP, Aws Cloudhsm, Hashicorp Vault, Thales Luna Hsm Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: e228c670f2142e981cac3f8e4138485e62fc6205f498d7d1139d97a40f0c6786