AWS kms documentation change
Summary
Added durability responsibilities, clarified rotation capabilities for single-Region keys, restricted key material changes to asymmetric/HMAC/multi-Region keys, and removed redundant content.
Security assessment
The documentation now explicitly states that users are responsible for key material durability and introduces on-demand rotation for single-Region symmetric keys. These changes emphasize security best practices (rotation) and operational responsibilities but do not indicate remediation of a specific security flaw.
Diff
diff --git a/kms/latest/developerguide/importing-keys-considerations.md b/kms/latest/developerguide/importing-keys-considerations.md index 219e6beb2..6137d36c0 100644 --- a//kms/latest/developerguide/importing-keys-considerations.md +++ b//kms/latest/developerguide/importing-keys-considerations.md @@ -13,0 +14,5 @@ You are responsible for generating the key material using a source of randomness +**You're responsible for availability and durability** + + +AWS KMS is designed to keep imported key material highly available. But AWS KMS does not maintain the durability of imported key material at the same level as key material that AWS KMS generates. For details, see [Protecting imported key material](./import-keys-protect.html). + @@ -19 +24 @@ You can [delete imported key material](./importing-keys-delete-key-material.html -**You cannot change the key material** +**You cannot change the key material for asymmetric, HMAC, and multi-Region keys** @@ -23,0 +29,5 @@ When you import key material into a KMS key, the KMS key is permanently associat +**You can perform on-demand rotation on single-Region, symmetric encryption keys** + + +Single-Region symmetric encryption keys with imported key material support on-demand rotation. You can [import multiple key materials ](./importing-keys-import-key-material.html#import-new-key-material) into these keys and use [on-demand rotation](./rotating-keys-on-demand.html) to update the current key material. The current key material is used for both encryption and decryption but other (non-current) key materials can only be used for decryption. + @@ -32 +42 @@ KMS keys designed for imported key material have an [origin](./create-keys.html# -You cannot export any key material that you imported. AWS KMS cannot return the imported key material to you in any form. You must maintain a copy of your imported key material outside of AWS, preferably in a key manager, such as a hardware security module (HSM), so you can re-import the key material if you delete it or it expires. +You cannot export any key material that you imported. AWS KMS cannot return the imported key material to you in any form. You must maintain a copy of your imported key material outside of AWS, preferably in a key manager, such as a hardware security module (HSM), so you can reimport the key material if you delete it or it expires. @@ -37 +47 @@ You cannot export any key material that you imported. AWS KMS cannot return the -Multi-Region with imported key material have the features of KMS keys with imported key material, and can interoperate between AWS Regions. To create a multi-Region key with imported key material, you must import the same key material into the primary KMS key and into each replica key. +Multi-Region with imported key material have the features of KMS keys with imported key material, and can interoperate between AWS Regions. To create a multi-Region key with imported key material, you must import the same key material into the primary KMS key and into each replica key. Multi-Region symmetric encryption keys do not support on-demand rotation. @@ -79,5 +88,0 @@ As a result, you cannot use keys with imported key material to support key escro -**You're responsible for availability and durability** - - -AWS KMS is designed to keep imported key material highly available. But AWS KMS does not maintain the durability of imported key material at the same level as key material that AWS KMS generates. For details, see [Protecting imported key material](./import-keys-protect.html). -