AWS kms documentation change
Summary
1) Removed multi-Region keys from key material change restrictions 2) Expanded on-demand rotation support to all symmetric keys 3) Added multi-Region import documentation reference
Security assessment
Expands documentation for multi-Region key management capabilities. No security vulnerabilities mentioned; changes clarify symmetric key behaviors and add reference to import procedures. Improves documentation of security features but doesn't address specific weaknesses.
Diff
diff --git a/kms/latest/developerguide/importing-keys-considerations.md b/kms/latest/developerguide/importing-keys-considerations.md index 850fceb29..6fb52293f 100644 --- a//kms/latest/developerguide/importing-keys-considerations.md +++ b//kms/latest/developerguide/importing-keys-considerations.md @@ -24 +24 @@ You can [delete imported key material](./importing-keys-delete-key-material.html -**You cannot change the key material for asymmetric, HMAC, and multi-Region keys** +**You cannot change the key material for asymmetric, and HMAC keys** @@ -29 +29 @@ When you import key material into a KMS key, the KMS key is permanently associat -**You can perform on-demand rotation on single-Region, symmetric encryption keys** +**You can perform on-demand rotation on symmetric encryption keys** @@ -32 +32 @@ When you import key material into a KMS key, the KMS key is permanently associat -Single-Region symmetric encryption keys with imported key material support on-demand rotation. You can [import multiple key materials ](./importing-keys-import-key-material.html#import-new-key-material) into these keys and use [on-demand rotation](./rotating-keys-on-demand.html) to update the current key material. The current key material is used for both encryption and decryption but other (non-current) key materials can only be used for decryption. +Symmetric encryption keys with imported key material support on-demand rotation. You can [import multiple key materials ](./importing-keys-import-key-material.html#import-new-key-material) into these keys and use [on-demand rotation](./rotating-keys-on-demand.html) to update the current key material. The current key material is used for both encryption and decryption but other (non-current) key materials can only be used for decryption. @@ -47 +47 @@ You cannot export any key material that you imported. AWS KMS cannot return the -Multi-Region with imported key material have the features of KMS keys with imported key material, and can interoperate between AWS Regions. To create a multi-Region key with imported key material, you must import the same key material into the primary KMS key and into each replica key. Multi-Region symmetric encryption keys do not support on-demand rotation. +Multi-Region with imported key material have the features of KMS keys with imported key material, and can interoperate between AWS Regions. To create a multi-Region key with imported key material, you must import the same key material into the primary KMS key and into each replica key. For more details on importing key materials for multi-Region keys, see [Multi-Region keys](./importing-keys-import-key-material.html#mrk-generalized-import-steps).