AWS kms documentation change
Summary
Updated CloudTrail examples for key rotation operations with new eventVersion (1.11), added key material tracking, managementEvent flag, and clarified external key rotation documentation
Security assessment
Added key material ID tracking and external key origin documentation improves key rotation transparency. Enhances security auditing capabilities but doesn't address a specific known vulnerability.
Diff
diff --git a/kms/latest/developerguide/ct-rotatekey.md b/kms/latest/developerguide/ct-rotatekey.md index f8e200fee..cb729fef4 100644 --- a//kms/latest/developerguide/ct-rotatekey.md +++ b//kms/latest/developerguide/ct-rotatekey.md @@ -15 +15 @@ For an example of the CloudTrail log entry that records the `EnableKeyRotation` - "eventVersion": "1.08", + "eventVersion": "1.11", @@ -20 +20 @@ For an example of the CloudTrail log entry that records the `EnableKeyRotation` - "eventTime": "2021-01-14T01:41:59Z", + "eventTime": "2025-05-20T20:44:37Z", @@ -37,0 +38 @@ For an example of the CloudTrail log entry that records the `EnableKeyRotation` + "managementEvent": true, @@ -40,0 +42,3 @@ For an example of the CloudTrail log entry that records the `EnableKeyRotation` + "keyOrigin": "AWS_KMS", + "previousKeyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0", + "currentKeyMaterialId": "96083e4fb6dbc41d77578a213a6b6669c044dd4c143e96755396d2bf11fd6068", @@ -46 +50 @@ For an example of the CloudTrail log entry that records the `EnableKeyRotation` -The following example shows a CloudTrail log entry for a [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) operation. For information about rotating symmetric encryption KMS keys on-demand, see [Perform on-demand key rotation](./rotating-keys-on-demand.html). +The following example shows a CloudTrail log entry for an on-demand rotation initiated by the [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) operation. For information about rotating symmetric encryption KMS keys on demand, see [Perform on-demand key rotation](./rotating-keys-on-demand.html). @@ -52 +56 @@ For an example of the CloudTrail log entry that records the `RotateKeyOnDemand` - "eventVersion": "1.08", + "eventVersion": "1.11", @@ -57 +61 @@ For an example of the CloudTrail log entry that records the `RotateKeyOnDemand` - "eventTime": "2021-01-14T01:41:59Z", + "eventTime": "2025-05-20T20:44:37Z", @@ -74,0 +79 @@ For an example of the CloudTrail log entry that records the `RotateKeyOnDemand` + "managementEvent": true, @@ -77,0 +83,3 @@ For an example of the CloudTrail log entry that records the `RotateKeyOnDemand` + "keyOrigin": "EXTERNAL", + "previousKeyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0", + "currentKeyMaterialId": "96083e4fb6dbc41d77578a213a6b6669c044dd4c143e96755396d2bf11fd6068",