AWS cli documentation change
Summary
Added documentation for new key material state 'PENDING_MULTI_REGION_IMPORT_AND_ROTATION' in multi-region keys with imported key material, clarifying rotation workflows
Security assessment
The change introduces documentation for a new key material state related to multi-region key rotation processes. While this clarifies security controls for key rotation in distributed systems, there is no evidence of addressing a specific vulnerability.
Diff
diff --git a/cli/latest/reference/kms/list-key-rotations.md b/cli/latest/reference/kms/list-key-rotations.md index d968fd8ef..5cd8a8c49 100644 --- a//cli/latest/reference/kms/list-key-rotations.md +++ b//cli/latest/reference/kms/list-key-rotations.md @@ -15 +15 @@ - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) » @@ -365 +365 @@ Rotations -> (list) ->>> There are three possible values for this field: `CURRENT` , `NON_CURRENT` and `PENDING_ROTATION` . KMS uses `CURRENT` key material for both encryption and decryption and `NON_CURRENT` key material only for decryption. `PENDING_ROTATION` identifies key material that has been imported for on-demand key rotation but the rotation hasn’t completed. Key material in `PENDING_ROTATION` is not permanently associated with the KMS key. You can delete this key material and import different key material in its place. The `PENDING_ROTATION` value is only used in symmetric encryption keys with imported key material. The other values, `CURRENT` and `NON_CURRENT` , are used for all KMS keys that support automatic or on-demand key rotation. +>>> There are four possible values for this field: `CURRENT` , `NON_CURRENT` , `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` and `PENDING_ROTATION` . KMS uses `CURRENT` key material for both encryption and decryption and `NON_CURRENT` key material only for decryption. `PENDING_ROTATION` identifies key material that has been imported for on-demand key rotation but the rotation hasn’t completed. The key material state `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` is unique to multi-region, symmetric encryption keys with imported key material. It indicates key material that has been imported into the primary Region key but not all of the replica Region keys. When this key material is imported in to all of the replica Region keys, the key material state will change to `PENDING_ROTATION` . Key material in `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` or `PENDING_ROTATION` state is not permanently associated with the KMS key. You can delete this key material and import different key material in its place. The `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` and `PENDING_ROTATION` values are only used in symmetric encryption keys with imported key material. The other values, `CURRENT` and `NON_CURRENT` , are used for all KMS keys that support automatic or on-demand key rotation. @@ -371,0 +372 @@ Rotations -> (list) +>>> * `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` @@ -431 +432 @@ Truncated -> (boolean) - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) »