AWS kms documentation change

Service: kms · 2025-06-07 · Documentation low

File: kms/latest/developerguide/symm-asymm-compare.md

Summary

Updated documentation to clarify support for on-demand key rotation (RotateKeyOnDemand) on symmetric encryption KMS keys with EXTERNAL origin and imported key material. Added details about DeriveSharedSecret and ListKeyRotations API operations.

Security assessment

The changes clarify key rotation capabilities and API support, which are security-relevant features. However, there is no evidence of addressing a specific security vulnerability. The updates improve documentation about security best practices (key rotation) but do not indicate a security fix.

Diff

diff --git a/kms/latest/developerguide/symm-asymm-compare.md b/kms/latest/developerguide/symm-asymm-compare.md
index e6445dcc7..653fd3c8f 100644
--- a//kms/latest/developerguide/symm-asymm-compare.md
+++ b//kms/latest/developerguide/symm-asymm-compare.md
@@ -61 +61 @@ AWS KMS API operation | Symmetric encryption KMS keys | HMAC KMS keys | Asymmetr
-[RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) | Yes Valid only on KMS keys with AWS KMS key material (`Origin` is `AWS_KMS`). | No | No | No | No  
+[RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) | Yes Valid only on customer-managed, symmetric encryption KMS keys with `AWS_KMS` or `EXTERNAL` origin. | No | No | No | No  
@@ -93,0 +94,2 @@ While reading this table, be aware of the following interactions:
+    * On-demand key rotation (`RotateKeyOnDemand`) is supported for single-Region, symmetric encryption KMS keys with imported key material.
+
@@ -117,0 +120 @@ AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in
+[DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only when `KeyUsage` is `KEY_AGREEMENT`) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only when `KeyUsage` is `KEY_AGREEMENT`) |  ![Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.](/images/kms/latest/developerguide/images/icon-failed.png)  
@@ -136,0 +140 @@ AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in
+[ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` origin. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on single-Region symmetric encryption keys. |  ![Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.](/images/kms/latest/developerguide/images/icon-failed.png)  
@@ -143,0 +148 @@ AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in
+[RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` origin. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on single-Region symmetric encryption keys. |  ![Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.](/images/kms/latest/developerguide/images/icon-failed.png)