How to use on-demand rotation for AWS KMS imported keys
Security Blog
AWS has announced on-demand rotation support for AWS Key Management Service (KMS) keys with imported key material. This new feature enables users to rotate cryptographic key material without changing the key identifier.
- Allows importing multiple key materials into a single symmetric encryption key
- Maintains the same key ID during rotation
- Provides new API operations like RotateKeyOnDemand and ListKeyRotations
- Adds key material identifiers to CloudTrail logs for improved auditability
- Supports optional key material expiration up to 365 days
Key benefits include maintaining key identifiers, flexible rotation, audit trails, and metadata management. Pricing includes a base cost with additional charges for the first two rotations. The feature is available in all AWS Regions where AWS KMS is supported.
The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.
The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.