AWS kms documentation change
Summary
Updated documentation to reflect support for both automatic and on-demand key rotation, added event details (rotation type, key material IDs), and updated example timestamps.
Security assessment
The changes clarify key rotation capabilities (including on-demand) and enhance event logging details. While key rotation is a security best practice, there is no evidence this addresses a specific vulnerability. The updates improve documentation of security features but do not indicate a security fix.
Diff
diff --git a/kms/latest/developerguide/kms-events.md b/kms/latest/developerguide/kms-events.md index e95bedb53..6f6b3b0b0 100644 --- a//kms/latest/developerguide/kms-events.md +++ b//kms/latest/developerguide/kms-events.md @@ -11 +11 @@ You can use Amazon EventBridge (formerly Amazon CloudWatch Events) to alert you - * The key material in a KMS key was automatically rotated. + * The key material in a KMS key was rotated automatically or on-demand. @@ -28 +28 @@ The following topics describe the EventBridge events that AWS KMS generates. -AWS KMS supports [automatic rotation](./rotate-keys.html) of the key material in symmetric encryption KMS keys. Annual key material rotation is optional for [customer managed keys](./concepts.html#customer-cmk). The key material for [AWS managed keys](./concepts.html#aws-managed-cmk) is automatically rotated every year. +AWS KMS supports [automatic and on-demand rotation](./rotate-keys.html) of the key material in symmetric encryption KMS keys. @@ -41 +41 @@ The following is an example of this event. - "time": "2022-08-10T16:37:50Z", + "time": "2025-05-23T03:11:54Z", @@ -47 +47,5 @@ The following is an example of this event. - "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab" + "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab", + "key-origin": "AWS_KMS", + "rotation-type": "ON_DEMAND", + "previous-key-material-id": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0", + "current-key-material-id": "96083e4fb6dbc41d77578a213a6b6669c044dd4c143e96755396d2bf11fd6068" @@ -64 +68 @@ The following is an example of this event. - "time": "2022-08-10T16:37:50Z", + "time": "2025-05-23T03:11:54Z", @@ -70 +74,2 @@ The following is an example of this event. - "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab" + "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab", + "key-material-id": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0" @@ -87 +92 @@ The following is an example of this event. - "time": "2022-08-10T16:37:50Z", + "time": "2025-05-23T03:11:54Z",