AWS kms documentation change

Service: kms · 2025-12-10 · Documentation medium

File: kms/latest/developerguide/symm-asymm-compare.md

Summary

Expanded key rotation support for symmetric encryption keys with EXTERNAL origin and removed single-Region restrictions

Security assessment

The changes document expanded support for key rotation scenarios (including EXTERNAL origin keys and multi-Region keys), which improves security posture but does not indicate a resolved vulnerability. Key rotation is a security best practice.

Diff

diff --git a/kms/latest/developerguide/symm-asymm-compare.md b/kms/latest/developerguide/symm-asymm-compare.md
index 653fd3c8f..0ae42e0f7 100644
--- a//kms/latest/developerguide/symm-asymm-compare.md
+++ b//kms/latest/developerguide/symm-asymm-compare.md
@@ -94 +94 @@ While reading this table, be aware of the following interactions:
-    * On-demand key rotation (`RotateKeyOnDemand`) is supported for single-Region, symmetric encryption KMS keys with imported key material.
+    * On-demand key rotation (`RotateKeyOnDemand`) is supported for symmetric encryption KMS keys with imported key material.
@@ -140 +140 @@ AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in
-[ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` origin. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on single-Region symmetric encryption keys. |  ![Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.](/images/kms/latest/developerguide/images/icon-failed.png)  
+[ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png)  
@@ -148 +148 @@ AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in
-[RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` origin. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on single-Region symmetric encryption keys. |  ![Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.](/images/kms/latest/developerguide/images/icon-failed.png)  
+[RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin. |  ![Green checkmark icon indicating success or completion.](/images/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys. |  ![Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.](/images/kms/latest/developerguide/images/icon-failed.png)