AWS kms documentation change
Summary
Added documentation about managing multiple key materials in symmetric encryption keys, introduced key-material-id parameter for selective deletion, updated console instructions for multi-key material management, and clarified key state transitions.
Security assessment
The changes document security-related features for managing imported key materials, including warnings about optional parameters and multi-key material handling. However, there's no evidence of addressing a specific vulnerability - this appears to be feature documentation improvements rather than patching a security issue.
Diff
diff --git a/kms/latest/developerguide/importing-keys-delete-key-material.md b/kms/latest/developerguide/importing-keys-delete-key-material.md index 1920254fa..734065f3c 100644 --- a//kms/latest/developerguide/importing-keys-delete-key-material.md +++ b//kms/latest/developerguide/importing-keys-delete-key-material.md @@ -7 +7 @@ -You can delete the imported key material from a KMS key at any time. Also, when imported key material with an expiration date expires, AWS KMS deletes the key material. In either case, when the key material is deleted, the [key state](./key-state.html) of the KMS key changes to _pending import_ , and the KMS key can't be used in any cryptographic operations until you [reimport the same key material](./importing-keys-import-key-material.html#reimport-key-material). (You cannot import any other key material into the KMS key.) +You can delete the imported key material from a KMS key at any time. Also, when imported key material with an expiration date expires, AWS KMS deletes the key material. In either case, when the key material is deleted, the [key state](./key-state.html) of the KMS key changes to _Pending import_ , and the KMS key can't be used in any cryptographic operations. @@ -9 +9,7 @@ You can delete the imported key material from a KMS key at any time. Also, when -Along with disabling the KMS key and withdrawing permissions, deleting key material can be used as a strategy to quickly, but temporarily, halt the use of the KMS key. In contrast, scheduling the deletion of a KMS key with imported key material also quickly halts the use of the KMS key. However, if the deletion is not canceled during the waiting period, the KMS key, the key material, and all key metadata are permanently deleted. For details, see [Deleting KMS keys with imported key material](./deleting-keys.html#import-delete-key). +Single-Region, symmetric encryption keys can have multiple key materials associated with them and the deletion or expiration of any key material in a state other than `PENDING_ROTATION` changes the key state to _Pending import_. For these keys, KMS assigns a unique identifier to each key material. You can use the [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) API to view these key material identifiers. You can delete a specific key material by specifying its identifier using the `key-material-id` parameter in the [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) API. + +###### Warning + +The `key-material-id` parameter is optional and if you do not specify it, AWS KMS will delete the current key material. + +Along with disabling the KMS key and withdrawing permissions, deleting key material can be used as a strategy to quickly, but temporarily, halt the use of the KMS key. In contrast, scheduling the deletion of a KMS key with imported key material also quickly halts the use of the KMS key. However, if the deletion is not canceled during the waiting period, the KMS key, associated key materials, and all key metadata are permanently deleted. For details, see [Deleting KMS keys with imported key material](./deleting-keys.html#import-delete-key). @@ -18 +24 @@ How deleting key material affects AWS services** -When you delete key material, the KMS key with no key material becomes unusable right away (subject to eventual consistency). However, resources encrypted with [data keys](./data-keys.html) protected by the KMS key are not affected until the KMS key is used again, such as to decrypt the data key. This issue affects AWS services, many of which use data keys to protect your resources. For details, see [How unusable KMS keys affect data keys](./unusable-kms-keys.html). +When you delete any key material, the KMS key becomes unusable right away (subject to eventual consistency). However, resources encrypted with [data keys](./data-keys.html) protected by the KMS key are not affected until the KMS key is used again, such as to decrypt the data key. This issue affects AWS services, many of which use data keys to protect your resources. For details, see [How unusable KMS keys affect data keys](./unusable-kms-keys.html). @@ -30 +36 @@ You can use the AWS KMS console to delete key material. - * Select the check box for a KMS key with imported key material. Choose **Key actions** , **Delete key material**. + * Select the check box for a KMS key with imported key material. Choose **Key actions** , **Delete key material**. For symmetric encryption keys that have multiple key materials associated with them, this will delete the current key material. @@ -32 +38 @@ You can use the AWS KMS console to delete key material. - * Choose the alias or key ID of a KMS key with imported key material. Choose the **Key material** tab and then choose **Delete key material**. + * For single-Region, symmetric encryption KMS keys with imported key material, choose the alias or key ID of a KMS key. Choose the **Key material and rotations** tab. The key material table will list all of the key materials associated with the key. Choose **Delete key material** from the **Actions** menu in the row corresponding to the key material you want to delete. @@ -34 +40 @@ You can use the AWS KMS console to delete key material. - 5. Confirm that you want to delete the key material and then choose **Delete key material**. The KMS key's status, which corresponds to its [key state](./key-state.html), changes to **Pending import**. + 5. Confirm that you want to delete the key material and then choose **Delete key material**. The KMS key's status, which corresponds to its [key state](./key-state.html), changes to **Pending import**. If the deleted key material was in `PENDING_ROTATION` state, there is no change to the KMS key's status. @@ -41 +47 @@ To use the [AWS KMS API](https://docs.aws.amazon.com/kms/latest/APIReference/) t -Replace ``1234abcd-12ab-34cd-56ef-1234567890ab`` with the key ID of the KMS key whose key material you want to delete. You can use the KMS key's key ID or ARN but you cannot use an alias for this operation. +Replace ``1234abcd-12ab-34cd-56ef-1234567890ab`` with the key ID of the KMS key whose key material you want to delete. You can use the KMS key's key ID or ARN but you cannot use an alias for this operation. The following command deletes the current key material which may be the only key material associated with the key. @@ -45,0 +52,7 @@ Replace ``1234abcd-12ab-34cd-56ef-1234567890ab`` with the key ID of the KMS key +To delete a specific key material, specify the key material identified using the `key-material-id` parameter. Replace ``123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0`` with the identifier of the key material you want to delete. + + + $ aws kms delete-imported-key-material --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \ + --key-material-id 123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0 + +