AWS cli documentation change
Summary
Removed restriction on multi-region keys with imported key material for on-demand rotation and updated rotation procedure
Security assessment
Enables documentation for on-demand rotation in multi-region imported key scenarios, promoting security best practices. The change appears to reflect feature enhancement rather than patching a security flaw.
Diff
diff --git a/cli/latest/reference/kms/rotate-key-on-demand.md b/cli/latest/reference/kms/rotate-key-on-demand.md index 2a0a612bd..3dfb12220 100644 --- a//cli/latest/reference/kms/rotate-key-on-demand.md +++ b//cli/latest/reference/kms/rotate-key-on-demand.md @@ -15 +15 @@ - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) » @@ -70 +70 @@ You can use GetKeyRotationStatus to identify any in progress on-demand rotations -On-demand key rotation is supported only on symmetric encryption KMS keys. You cannot perform on-demand rotation of [asymmetric KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html) , [HMAC KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html) , multi-Region KMS keys with [imported key material](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html) , or KMS keys in a [custom key store](https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html) . When you initiate on-demand key rotation on a symmetric encryption KMS key with imported key material, you must have already imported [new key material](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html) and that key material’s state should be `PENDING_ROTATION` . Use the `ListKeyRotations` operation to check the state of all key materials associated with a KMS key. To perform on-demand rotation of a set of related [multi-Region keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate) , invoke the on-demand rotation on the primary key. +On-demand key rotation is supported only on symmetric encryption KMS keys. You cannot perform on-demand rotation of [asymmetric KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html) , [HMAC KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html) , or KMS keys in a [custom key store](https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html) . When you initiate on-demand key rotation on a symmetric encryption KMS key with imported key material, you must have already imported [new key material](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html) and that key material’s state should be `PENDING_ROTATION` . Use the `ListKeyRotations` operation to check the state of all key materials associated with a KMS key. To perform on-demand rotation of a set of related [multi-Region keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate) , import new key material in the primary Region key, import the same key material in each replica Region key, and invoke the on-demand rotation on the primary Region key. @@ -292 +292 @@ KeyId -> (string) - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) »