AWS kms documentation change
Summary
Removed restriction on on-demand rotation for multi-Region KMS keys with imported key material, expanding support to all symmetric encryption KMS keys with imported key material.
Security assessment
Expanding on-demand rotation capabilities improves security practices by allowing more keys to be rotated, but there's no evidence this fixes a specific security vulnerability.
Diff
diff --git a/kms/latest/developerguide/rotate-keys.md b/kms/latest/developerguide/rotate-keys.md index 9ac373f18..f000f52a3 100644 --- a//kms/latest/developerguide/rotate-keys.md +++ b//kms/latest/developerguide/rotate-keys.md @@ -96 +96 @@ Immediately initiate rotation of the key material associated with your KMS key, -On-demand key rotation is supported on symmetric encryption KMS keys with key material that AWS KMS generates (`AWS_KMS` origin) and single-Region, symmetric encryption KMS keys with imported key material (`EXTERNAL` origin). +On-demand key rotation is supported on symmetric encryption KMS keys with key material that AWS KMS generates (`AWS_KMS` origin) and symmetric encryption KMS keys with imported key material (`EXTERNAL` origin). @@ -111,2 +110,0 @@ Neither automatic nor on-demand key rotation is supported for the following type - * Multi-Region KMS keys with [imported key material](./importing-keys.html) -