AWS kms documentation change
Summary
Updated documentation about KMS key details page to clarify key rotation capabilities and key material management. Added sections about current key material tracking, multi-key material support, and expanded rotation configuration options.
Security assessment
The changes enhance documentation about cryptographic key management features (rotation policies, key material lifecycle) which are security-related controls, but there's no evidence of addressing a specific vulnerability. The updates provide clearer guidance on security best practices for key rotation and material management.
Diff
diff --git a/kms/latest/developerguide/finding-keys.md b/kms/latest/developerguide/finding-keys.md index 5718e8bb8..f280de4bb 100644 --- a//kms/latest/developerguide/finding-keys.md +++ b//kms/latest/developerguide/finding-keys.md @@ -15 +15 @@ To display detailed information about a KMS key, on the **AWS managed keys** or -The details page for a KMS key includes a **General Configuration** section that displays the basic properties of the KMS key. It also includes tabs on which you can view and edit properties of the KMS key, such as **Key policy** , **Cryptographic configuration** , **Tags** , **Key material** (for KMS keys with imported key material), **Key rotation** (for symmetric encryption KMS keys), **Regionality** (for multi-Region keys), and **Public key** (for asymmetric KMS keys). +The details page for a KMS key includes a **General Configuration** section that displays the basic properties of the KMS key. It also includes tabs on which you can view and edit properties of the KMS key, such as **Key policy** , **Cryptographic configuration** , **Tags** , **Key material and rotations** (for KMS keys that support automatic or on-demand rotation), **Regionality** (for multi-Region keys), and **Public key** (for asymmetric KMS keys). @@ -80,0 +81,7 @@ If you choose the CloudHSM cluster ID, it opens the **Clusters** page in the AWS +**Current key material** + + +Where: General configuration section + +Symmetric encryption keys with `AWS_KMS` origin support both automatic and on-demand rotation. Single-Region, symmetric encryption keys with `EXTERNAL` origin support on-demand rotation. These keys can have multiple key materials associated with the key. The most recently rotated key material can be used for both encryption and decryption. This key material is identified as the current key material. Other key materials can only be used for decryption. Automatic or on-demand key rotation of a KMS key changes its current key material. + @@ -123 +130 @@ Where: Key material tab -The date and time when the key material for the KMS key expires. This field appears only for KMS keys with [imported key material](./importing-keys.html), that is, when the **Origin** is **External** and the KMS key has key material that expires. +The date and time when the key material for the KMS key expires. This field appears only for KMS keys with [imported key material](./importing-keys.html), that is, when the **Origin** is **External** and the KMS key has key material that expires. Single-Region, symmetric encryption keys can have multiple key materials associated with them. For such keys, this field indicates the earliest date and time when one of the associated key materials expires. @@ -153 +160,6 @@ Controls access to the KMS key along with [IAM policies](./iam-policies.html) an -**Key rotation** +**Key material and rotations** + + +Where: Key material and rotations tab + +This tab only appears for symmetric encryption keys with `AWS_KMS` origin (which support both automatic and on-demand rotation) as well as single-Region, symmetric encryption keys with `EXTERNAL` origin (which support on-demand rotation). @@ -154,0 +167 @@ Controls access to the KMS key along with [IAM policies](./iam-policies.html) an +The tab has three panels: @@ -156 +169 @@ Controls access to the KMS key along with [IAM policies](./iam-policies.html) an -Where: Key rotation tab +Automatic rotation: Enables and disables [automatic rotation](./rotate-keys.html) of the key material in a [customer managed KMS key](./concepts.html#customer-cmk). To change the key rotation status of a [customer managed key](./concepts.html#customer-cmk), use the check box. You can't enable or disable rotation of the key material in an [AWS managed key](./concepts.html#aws-managed-cmk). AWS managed keys are automatically rotated every year. @@ -158 +171 @@ Where: Key rotation tab -Enables and disables [automatic rotation](./rotate-keys.html) of the key material in a [customer managed KMS key](./concepts.html#customer-cmk). To change the key rotation status of a [customer managed key](./concepts.html#customer-cmk), use the check box on the **Key rotation** tab. +On-demand rotation: Initiate an [on-demand rotation](./rotate-keys.html) of the key material in a [customer managed key](./concepts.html#customer-cmk). For imported keys, there must already be an imported key material in `PENDING_ROTATION` state for the **Rotate now** option to be available. @@ -160 +173 @@ Enables and disables [automatic rotation](./rotate-keys.html) of the key materia -You can't enable or disable rotation of the key material in an [AWS managed key](./concepts.html#aws-managed-cmk). AWS managed keys are automatically rotated every year. +Key materials: Lists all of the key materials associated with the KMS key. Each key material has a unique identifier and its row displays additional information about the key material such as the rotation date when the key material became available to use in KMS. For imported keys, each row also has an **Actions** menu that can be used to delete a specific key material or reimport it into the KMS key. @@ -298 +311,2 @@ For example, this call to `DescribeKey` returns information about a symmetric en - ] + ], + "CurrentKeyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"