AWS kms documentation change
Summary
Removed 'Single-Region' qualifier for symmetric encryption keys and added multi-Region key considerations section explaining behavior when deleting key material in primary/replica Regions
Security assessment
The changes clarify operational behavior of key material deletion in multi-Region scenarios but do not address a specific security vulnerability. The added documentation explains security-relevant features (key material lifecycle management) without indicating a patched issue.
Diff
diff --git a/kms/latest/developerguide/importing-keys-delete-key-material.md b/kms/latest/developerguide/importing-keys-delete-key-material.md index 734065f3c..ae0b91d48 100644 --- a//kms/latest/developerguide/importing-keys-delete-key-material.md +++ b//kms/latest/developerguide/importing-keys-delete-key-material.md @@ -9 +9,10 @@ You can delete the imported key material from a KMS key at any time. Also, when -Single-Region, symmetric encryption keys can have multiple key materials associated with them and the deletion or expiration of any key material in a state other than `PENDING_ROTATION` changes the key state to _Pending import_. For these keys, KMS assigns a unique identifier to each key material. You can use the [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) API to view these key material identifiers. You can delete a specific key material by specifying its identifier using the `key-material-id` parameter in the [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) API. +Symmetric encryption keys can have multiple key materials associated with them and the deletion or expiration of any key material in a state other than `PENDING_ROTATION` changes the key state to _Pending import_. For these keys, KMS assigns a unique identifier to each key material. You can use the [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) API to view these key material identifiers. You can delete a specific key material by specifying its identifier using the `key-material-id` parameter in the [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) API. + +###### Considerations for multi-Region keys + + * When you delete the key material of a primary Region key that is in `PENDING_ROTATION` or `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` state, you'll also be deleting the key materials for the replica Region keys. + + * If you delete the key material of a replica Region key, the primary Region key and other replica Region keys remain unchanged. + + + @@ -38 +47 @@ You can use the AWS KMS console to delete key material. - * For single-Region, symmetric encryption KMS keys with imported key material, choose the alias or key ID of a KMS key. Choose the **Key material and rotations** tab. The key material table will list all of the key materials associated with the key. Choose **Delete key material** from the **Actions** menu in the row corresponding to the key material you want to delete. + * For symmetric encryption KMS keys with imported key material, choose the alias or key ID of a KMS key. Choose the **Key material and rotations** tab. The key material table will list all of the key materials associated with the key. Choose **Delete key material** from the **Actions** menu in the row corresponding to the key material you want to delete.