AWS kms documentation change
Summary
Added documentation about on-demand rotations and multiple key materials for Single-Region symmetric keys with EXTERNAL origin. Updated expiration behavior explanation for keys with multiple materials.
Security assessment
The changes clarify operational aspects of key rotation and expiration management for imported keys, which are security-related features. However, there's no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/kms/latest/developerguide/identify-key-types.md b/kms/latest/developerguide/identify-key-types.md index 6e41f0244..cf8cea6e4 100644 --- a//kms/latest/developerguide/identify-key-types.md +++ b//kms/latest/developerguide/identify-key-types.md @@ -104 +104 @@ To make it easier to identify KMS keys with imported key material in the **Custo -The **Cryptographic configuration** tab on the details page for a KMS key displays the **Origin** , which identifies the source of the key material for the KMS key. For KMS keys with imported key material, the origin value is always **External (Import Key material)**. The details page also includes a **Key material** tab that provides detailed information about the imported key material. The **Key material** tab only appears on the detail page for KMS keys with imported key material. +The **Cryptographic configuration** tab on the details page for a KMS key displays the **Origin** , which identifies the source of the key material for the KMS key. For KMS keys with imported key material, the origin value is always **External (Import Key material)**. The details page also includes a **Key material** tab that provides detailed information about the imported key material. Single-Region, symmetric encryption keys with `EXTERNAL` origin support on-demand rotations and can have multiple key materials associated with them. For such keys, the tab is labeled **Key material and rotations**. @@ -109 +109 @@ The **Cryptographic configuration** tab on the details page for a KMS key displa -When you call the `DescribeKey` operation on a KMS key with imported key material the response includes the `Origin`, `ExpirationModel`, and `ValidTo` values. For KMS keys with imported key material the origin value is always `EXTERNAL`. The `ExpirationModel` value indicates whether or not the key material is set to expire, and the `ValidTo` value indicates when the key material will expire. For more information, see [Setting an expiration time (optional)](./importing-keys-import-key-material.html#importing-keys-expiration). +When you call the `DescribeKey` operation on a KMS key with imported key material the response includes the `Origin`, `ExpirationModel`, and `ValidTo` values. For KMS keys with imported key material the origin value is always `EXTERNAL`. The `ExpirationModel` value indicates whether or not the key material is set to expire, and the `ValidTo` value indicates when the key material will expire. When multiple key materials are associated with a key, the `ValidTo` value indicates the earliest expiry time across all key materials (except for the one pending rotation) and `ExpirationModel` is set to `DOES_NOT_EXPIRE` only if none of these key materials are set to expire. For more information, see [Setting an expiration time (optional)](./importing-keys-import-key-material.html#importing-keys-expiration).