AWS Security ChangesHomeSearch

AWS aws-backup documentation change

Service: aws-backup · 2026-03-25 · Documentation medium

File: aws-backup/latest/devguide/logicallyairgappedvault.md

Summary

Added a new section 'Usage of service-owned key' detailing how AWS Backup creates and manages encryption keys for logically air-gapped vaults, including key specs, rotation policy, and deletion behavior.

Security assessment

This change adds documentation about a security feature: encryption key management for logically air-gapped vaults. It explains how keys are created, managed, and rotated to protect backup data. However, there is no evidence that this addresses a specific security vulnerability or incident; it is informational.

Diff

diff --git a/aws-backup/latest/devguide/logicallyairgappedvault.md b/aws-backup/latest/devguide/logicallyairgappedvault.md
index a0169f1db..e3f23eb67 100644
--- a//aws-backup/latest/devguide/logicallyairgappedvault.md
+++ b//aws-backup/latest/devguide/logicallyairgappedvault.md
@@ -5 +5 @@
-Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsTroubleshoot a logically air-gapped vault issue
+Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsUsage of service-owned keyTroubleshoot a logically air-gapped vault issue
@@ -46,0 +47,2 @@ See [Feature availability by resource](./backup-feature-availability.html#featur
+  * Usage of service-owned key
+
@@ -793,0 +796,19 @@ When working with logically air-gapped vaults and encryption key types, consider
+## Usage of service-owned key
+
+AWS Backup creates and manages encryption keys that are used to encrypt all the backup data stored in logically air-gapped vaults, to protect and prevent loss of access of the encryption key during a data loss event.
+
+  * These keys are free of charge and do not count against the AWS KMS quotas for your account.
+
+  * A single key is only used for a specific vault and is not shared with any other account or other purpose.
+
+  * These keys are deleted once the assigned (empty) vault is also deleted.
+
+  * These keys are created using the [SYMMETRIC_DEFAULT key spec](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html#symmetric-cmks).
+
+  * The default rotation policy is 90 days. You can request rotation (once every 6 months) of service-owned encryption keys for your logically air-gapped vaults through a support ticket.
+
+
+
+
+Visit the [AWS KMS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) to learn more.
+