AWS kms documentation change
Summary
Updated key state documentation with clarifications about state transitions, added DeriveSharedSecret operation to the table, and revised footnotes for operation constraints.
Security assessment
The changes clarify key state behavior (e.g., imported key material expiration triggering PendingImport state) and document the DeriveSharedSecret operation's availability across key states. While these updates improve security transparency, there is no explicit evidence of addressing a specific vulnerability. The added operation documentation and state transition details enhance understanding of security controls but do not indicate a direct security fix.
Diff
diff --git a/kms/latest/developerguide/key-state.md b/kms/latest/developerguide/key-state.md index 0c9982d60..b3c18be8d 100644 --- a//kms/latest/developerguide/key-state.md +++ b//kms/latest/developerguide/key-state.md @@ -9 +9 @@ Key states and KMS key typesKey state table -An AWS KMS key always has a key state. Operations on the KMS key and its environment can change that key state, either transiently, or until another operation changes its key state. +An AWS KMS key always has a key state. Operations on the KMS key and its environment can change the key state. The key state can change either transiently, or until another operation changes its key state. These operations are done either asynchronously, or by an API call. @@ -32 +32 @@ The type of the KMS key determines the key states it can have. - * The `PendingImport` state applies only to KMS keys with [imported key material](./importing-keys.html). + * The `PendingImport` state applies only to KMS keys with [imported key material](./importing-keys.html). When any key material for an imported key is deleted or it expires, then the state changes from `Enabled` to `PendingImport`. @@ -66 +66,2 @@ DeleteAlias |  [9] |  [9] |  [9] |  (No effect) | N/A |  [14] |  [15] +DeleteImportedKeyMaterial |  [9] |  [9] |  [9] |  | N/A |  [14] |  [15] +DeriveSharedSecret |  | [1] |  [2] or [3] | [5] | N/A |  [14] |  @@ -74,2 +75,2 @@ GenerateDataKey |  | [1] |  [2] or [3] | [5] |  [11] |  [14] |  -GenerateDataKeyPairWithoutPlaintext |  | [1] |  [2] or [3] | [5] |  [11] |  [14] |  +GenerateDataKeyPair |  | [1] |  [2] or [3] | [5] |  [7] |  [14] |  +GenerateDataKeyPairWithoutPlaintext |  | [1] |  [2] or [3] | [5] |  [7] |  [14] |  @@ -77 +78 @@ GenerateDataKeyWithoutPlaintext |  | [1] |  [2] or [3] | N/A | N/A |  [14] |  +GenerateMac |  | [1] |  [2] or [3] | [5] | N/A |  [14] |  @@ -81,2 +82,2 @@ GetParametersForImport |  |  |  [2] or [3] | N/A | N/A |  [14] |  -ImportKeyMaterial |  [9] |  [9] |  [8] or [9] |  |  [9] |  [14] |  +GetPublicKey |  |  |  [2] or [3] |  | N/A |  [14] |  +ImportKeyMaterial |  [9] |  [9] |  [9] |  |  [9] |  [14] |  @@ -93 +94 @@ RevokeGrant |  [7] |  [1] or [7] |  [3] or [7] | [6] |  [7] |  [14] |  [7] +RotateKeyOnDemand |  [7] |  [1] or [7] |  [3] or [7] | [5] |  [7] |  [14] |  [7] @@ -95 +96 @@ ScheduleKeyDeletion |  |  [1] |  [2] or [3] | N/A | N/A |  [14] |  +Sign |  |  [1] |  [2] or [3] | [5] | N/A |  [14] |  @@ -101,2 +102,2 @@ UpdatePrimaryRegion |  |  [1] |  [2] or [3] | N/A | N/A |  [14] |  -VerifyMac |  | [1] |  [2] or [3] | N/A | N/A |  [14] |  +Verify |  |  [1] |  [2] or [3] | [5] | N/A |  [14] |  +VerifyMac |  | [1] |  [2] or [3] | [5] | N/A |  [14] |  @@ -114 +115 @@ VerifyMac | ![Green checkmark icon indicating success or completion.](/images/km - * [5] `KMSInvalidStateException: `<key ARN>` is pending import.` + * [5] `KMSInvalidStateException: `<key ARN>` is pending import because no key material has ever been imported or one of the imported key materials is deleted or expired.` @@ -118 +119 @@ VerifyMac | ![Green checkmark icon indicating success or completion.](/images/km - * [7] If the KMS key has imported key material or is in a custom key store: `UnsupportedOperationException`. + * [7] If the KMS key is in a custom key store: `UnsupportedOperationException`. @@ -122 +123 @@ VerifyMac | ![Green checkmark icon indicating success or completion.](/images/km - * [9] If the KMS key cannot or does not have imported key material: `UnsupportedOperationException`. + * [9] If the KMS key cannot have imported key material: `UnsupportedOperationException`.