AWS aws-backup documentation change
Summary
Added a new section 'Usage of service-owned key' detailing how AWS Backup creates and manages encryption keys for logically air-gapped vaults, including key specs, rotation policy, and deletion behavior.
Security assessment
This change adds documentation about a security feature: encryption key management for logically air-gapped vaults. It explains how keys are created, managed, and rotated to protect backup data. However, there is no evidence that this addresses a specific security vulnerability or incident; it is informational.
Diff
diff --git a/aws-backup/latest/devguide/logicallyairgappedvault.md b/aws-backup/latest/devguide/logicallyairgappedvault.md index a0169f1db..e3f23eb67 100644 --- a//aws-backup/latest/devguide/logicallyairgappedvault.md +++ b//aws-backup/latest/devguide/logicallyairgappedvault.md @@ -5 +5 @@ -Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsTroubleshoot a logically air-gapped vault issue +Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsUsage of service-owned keyTroubleshoot a logically air-gapped vault issue @@ -46,0 +47,2 @@ See [Feature availability by resource](./backup-feature-availability.html#featur + * Usage of service-owned key + @@ -793,0 +796,19 @@ When working with logically air-gapped vaults and encryption key types, consider +## Usage of service-owned key + +AWS Backup creates and manages encryption keys that are used to encrypt all the backup data stored in logically air-gapped vaults, to protect and prevent loss of access of the encryption key during a data loss event. + + * These keys are free of charge and do not count against the AWS KMS quotas for your account. + + * A single key is only used for a specific vault and is not shared with any other account or other purpose. + + * These keys are deleted once the assigned (empty) vault is also deleted. + + * These keys are created using the [SYMMETRIC_DEFAULT key spec](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html#symmetric-cmks). + + * The default rotation policy is 90 days. You can request rotation (once every 6 months) of service-owned encryption keys for your logically air-gapped vaults through a support ticket. + + + + +Visit the [AWS KMS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) to learn more. +