AWS kms documentation change
Summary
Clarified metric description for imported key material expiration tracking and emphasized proactive reimport action
Security assessment
The change improves guidance about monitoring key material expiration and stresses the need to reimport before expiration to maintain key usability. While this relates to operational security best practices, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/kms/latest/developerguide/monitoring-cloudwatch.md b/kms/latest/developerguide/monitoring-cloudwatch.md index 387b24d46..5bd45b187 100644 --- a//kms/latest/developerguide/monitoring-cloudwatch.md +++ b//kms/latest/developerguide/monitoring-cloudwatch.md @@ -86 +86 @@ Operation | Value for each AWS KMS API operation, in this case, ReEncrypt. -The number of seconds remaining until the [imported key material](./importing-keys.html) in a KMS key expires. This metric is valid only for KMS keys with imported key material (a [key material origin](./create-keys.html#key-origin) of `EXTERNAL`) and an expiration date. +The number of seconds remaining until the earliest-expiring [imported key material](./importing-keys.html) in a KMS key. This metric is valid only for KMS keys with imported key material (a [key material origin](./create-keys.html#key-origin) of `EXTERNAL`) and an expiration date. @@ -88 +88 @@ The number of seconds remaining until the [imported key material](./importing-ke -Use this metric to track the time that remains until your imported key material expires. When that time falls below a threshold that you define, you might want to reimport the key material with a new expiration date. The `SecondsUntilKeyMaterialExpiration` metric is specific to a KMS key. You cannot use this metric to monitor multiple KMS keys or KMS keys that you might create in the future. For help with creating a CloudWatch alarm to monitor this metric, see [Create a CloudWatch alarm for expiration of imported key material](./imported-key-material-expiration-alarm.html). +Use this metric to track how much time is left before your earliest-expiring imported key material expires. When that time falls below a threshold that you define, you should reimport the key material with a new expiration date to keep the KMS key usable. The `SecondsUntilKeyMaterialExpiration` metric is specific to a KMS key. You cannot use this metric to monitor multiple KMS keys or KMS keys that you might create in the future. For help with creating a CloudWatch alarm to monitor this metric, see [Create a CloudWatch alarm for expiration of imported key material](./imported-key-material-expiration-alarm.html).