AWS kms documentation change
Summary
Removed 'single-Region' qualifier from descriptions of KMS keys with imported key material
Security assessment
Generalizes documentation about key rotation for imported keys without indicating any security vulnerability. The change documents security feature (key rotation) but shows no evidence of addressing a specific security issue.
Diff
diff --git a/kms/latest/developerguide/list-rotations.md b/kms/latest/developerguide/list-rotations.md index bb09a13d8..647f8aabb 100644 --- a//kms/latest/developerguide/list-rotations.md +++ b//kms/latest/developerguide/list-rotations.md @@ -34 +34 @@ Authorized users with `kms:ListKeyRotations` permission can use the AWS KMS cons - * The **Key material and rotations** tab appears only on the detail page of symmetric encryption KMS keys that support automatic or on-demand rotation. This includes KMS keys with key material that AWS KMS generated (`AWS_KMS` origin) and single-Region KMS keys with imported key material (`EXTERNAL` origin). + * The **Key material and rotations** tab appears only on the detail page of symmetric encryption KMS keys that support automatic or on-demand rotation. This includes KMS keys with key material that AWS KMS generated (`AWS_KMS` origin) and KMS keys with imported key material (`EXTERNAL` origin). @@ -40 +40 @@ Authorized users with `kms:ListKeyRotations` permission can use the AWS KMS cons - * Single-Region, symmetric encryption KMS keys with imported key material (`EXTERNAL` origin) only support `On-demand` rotation, so there is no rotation type column. Instead, each row displays an import state, a user-specified description, expiration information, and an **Actions** menu. The import state is either **Imported** indicating the key material is available inside AWS KMS or **Pending import** indicating the key material is not available inside AWS KMS. The **Actions** menu can be used to delete imported key material or reimport key material. The **Delete key material** action is disabled if the import state of the key material is **Pending import**. The **Reimport key material** action is always available. You do not need to wait for a key material to expire or be deleted before reimporting it. + * Symmetric encryption KMS keys with imported key material (`EXTERNAL` origin) only support `On-demand` rotation, so there is no rotation type column. Instead, each row displays an import state, a user-specified description, expiration information, and an **Actions** menu. The import state is either **Imported** indicating the key material is available inside AWS KMS or **Pending import** indicating the key material is not available inside AWS KMS. The **Actions** menu can be used to delete imported key material or reimport key material. The **Delete key material** action is disabled if the import state of the key material is **Pending import**. The **Reimport key material** action is always available. You do not need to wait for a key material to expire or be deleted before reimporting it.