AWS kms documentation change
Summary
Removed references to multi-Region KMS keys with imported key material being excluded from on-demand rotation, aligning with expanded support.
Security assessment
This change documents broader support for on-demand key rotation (a security feature), but does not address a specific security vulnerability.
Diff
diff --git a/kms/latest/developerguide/rotating-keys-on-demand.md b/kms/latest/developerguide/rotating-keys-on-demand.md index 21e3d71bb..e3de3435b 100644 --- a//kms/latest/developerguide/rotating-keys-on-demand.md +++ b//kms/latest/developerguide/rotating-keys-on-demand.md @@ -13 +13 @@ You can perform on-demand key rotation a maximum of 10 times per KMS key. You ca -On-demand key rotation is supported only on [symmetric encryption KMS keys](./symm-asymm-choose-key-spec.html#symmetric-cmks). You cannot perform on-demand rotation of [asymmetric KMS keys](./symmetric-asymmetric.html), [HMAC KMS keys](./hmac.html), multi-Region KMS keys with [imported key material](./importing-keys.html), or KMS keys in a [custom key store](./key-store-overview.html#custom-key-store-overview). To perform on-demand rotation of a set of related [multi-Region keys](./rotate-keys.html#multi-region-rotate), invoke the on-demand rotation on the primary key. +On-demand key rotation is supported only on [symmetric encryption KMS keys](./symm-asymm-choose-key-spec.html#symmetric-cmks). You cannot perform on-demand rotation of [asymmetric KMS keys](./symmetric-asymmetric.html), [HMAC KMS keys](./hmac.html), or KMS keys in a [custom key store](./key-store-overview.html#custom-key-store-overview). To perform on-demand rotation of a set of related [multi-Region keys](./rotate-keys.html#multi-region-rotate), invoke the on-demand rotation on the primary key. @@ -38 +38 @@ Authorized users with `kms:RotateKeyOnDemand` and `kms:GetKeyRotationStatus` per -The **Key material and rotations** tab appears only on the detail page of symmetric encryption KMS keys that support automatic or on-demand rotation. This includes KMS keys with key material that AWS KMS generated (**AWS_KMS** origin) and single-Region KMS keys with imported key material (**EXTERNAL** origin). +The **Key material and rotations** tab appears only on the detail page of symmetric encryption KMS keys that support automatic or on-demand rotation. This includes KMS keys with key material that AWS KMS generated (**AWS_KMS** origin) and KMS keys with imported key material (**EXTERNAL** origin) @@ -40 +40 @@ The **Key material and rotations** tab appears only on the detail page of symmet -You cannot perform on-demand rotation of asymmetric KMS keys, HMAC KMS keys, multi-Region KMS keys with [imported key material](./importing-keys.html), or KMS keys in [custom key stores](./key-store-overview.html#custom-key-store-overview). However, you can [rotate them manually](./rotate-keys-manually.html). +You cannot perform on-demand rotation of asymmetric KMS keys, HMAC KMS keys, or KMS keys in [custom key stores](./key-store-overview.html#custom-key-store-overview). However, you can [rotate them manually](./rotate-keys-manually.html). @@ -42 +42,5 @@ You cannot perform on-demand rotation of asymmetric KMS keys, HMAC KMS keys, mul - 6. Choose **Rotate now**. For single-Region, symmetric encryption keys with imported key material, the **Rotate now** option is available only if you have previously [imported new key material](./importing-keys-import-key-material.html#import-new-key-material) and it is in **Pending rotation** state. + 6. Choose **Rotate now**. For symmetric encryption keys with imported key material, the **Rotate now** option is available only if you have previously [imported new key material](./importing-keys-import-key-material.html#import-new-key-material) and it is in **Pending rotation** state. + +###### Note + +For multi-Region keys, only the primary Region key can be rotated.