Skip to content

Commit b4a9a68

Browse files
author
awstools
committed
feat(client-kms): This feature supports the ability to specify a custom rotation period for automatic key rotations, the ability to perform on-demand key rotations, and visibility into your key material rotations.
1 parent a999161 commit b4a9a68

16 files changed

+1183
-51
lines changed

‎clients/client-kms/README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,14 @@ ListKeyPolicies
553553

554554
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ListKeyPoliciesCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/ListKeyPoliciesCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/ListKeyPoliciesCommandOutput/)
555555

556+
</details>
557+
<details>
558+
<summary>
559+
ListKeyRotations
560+
</summary>
561+
562+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ListKeyRotationsCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/ListKeyRotationsCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/ListKeyRotationsCommandOutput/)
563+
556564
</details>
557565
<details>
558566
<summary>
@@ -617,6 +625,14 @@ RevokeGrant
617625

618626
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/RevokeGrantCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/RevokeGrantCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/RevokeGrantCommandOutput/)
619627

628+
</details>
629+
<details>
630+
<summary>
631+
RotateKeyOnDemand
632+
</summary>
633+
634+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/RotateKeyOnDemandCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/RotateKeyOnDemandCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-kms/Interface/RotateKeyOnDemandCommandOutput/)
635+
620636
</details>
621637
<details>
622638
<summary>

‎clients/client-kms/src/KMS.ts‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,11 @@ import {
114114
ListKeyPoliciesCommandInput,
115115
ListKeyPoliciesCommandOutput,
116116
} from "./commands/ListKeyPoliciesCommand";
117+
import {
118+
ListKeyRotationsCommand,
119+
ListKeyRotationsCommandInput,
120+
ListKeyRotationsCommandOutput,
121+
} from "./commands/ListKeyRotationsCommand";
117122
import { ListKeysCommand, ListKeysCommandInput, ListKeysCommandOutput } from "./commands/ListKeysCommand";
118123
import {
119124
ListResourceTagsCommand,
@@ -138,6 +143,11 @@ import {
138143
} from "./commands/ReplicateKeyCommand";
139144
import { RetireGrantCommand, RetireGrantCommandInput, RetireGrantCommandOutput } from "./commands/RetireGrantCommand";
140145
import { RevokeGrantCommand, RevokeGrantCommandInput, RevokeGrantCommandOutput } from "./commands/RevokeGrantCommand";
146+
import {
147+
RotateKeyOnDemandCommand,
148+
RotateKeyOnDemandCommandInput,
149+
RotateKeyOnDemandCommandOutput,
150+
} from "./commands/RotateKeyOnDemandCommand";
141151
import {
142152
ScheduleKeyDeletionCommand,
143153
ScheduleKeyDeletionCommandInput,
@@ -203,6 +213,7 @@ const commands = {
203213
ListAliasesCommand,
204214
ListGrantsCommand,
205215
ListKeyPoliciesCommand,
216+
ListKeyRotationsCommand,
206217
ListKeysCommand,
207218
ListResourceTagsCommand,
208219
ListRetirableGrantsCommand,
@@ -211,6 +222,7 @@ const commands = {
211222
ReplicateKeyCommand,
212223
RetireGrantCommand,
213224
RevokeGrantCommand,
225+
RotateKeyOnDemandCommand,
214226
ScheduleKeyDeletionCommand,
215227
SignCommand,
216228
TagResourceCommand,
@@ -679,6 +691,23 @@ export interface KMS {
679691
cb: (err: any, data?: ListKeyPoliciesCommandOutput) => void
680692
): void;
681693

694+
/**
695+
* @see {@link ListKeyRotationsCommand}
696+
*/
697+
listKeyRotations(
698+
args: ListKeyRotationsCommandInput,
699+
options?: __HttpHandlerOptions
700+
): Promise<ListKeyRotationsCommandOutput>;
701+
listKeyRotations(
702+
args: ListKeyRotationsCommandInput,
703+
cb: (err: any, data?: ListKeyRotationsCommandOutput) => void
704+
): void;
705+
listKeyRotations(
706+
args: ListKeyRotationsCommandInput,
707+
options: __HttpHandlerOptions,
708+
cb: (err: any, data?: ListKeyRotationsCommandOutput) => void
709+
): void;
710+
682711
/**
683712
* @see {@link ListKeysCommand}
684713
*/
@@ -781,6 +810,23 @@ export interface KMS {
781810
cb: (err: any, data?: RevokeGrantCommandOutput) => void
782811
): void;
783812

813+
/**
814+
* @see {@link RotateKeyOnDemandCommand}
815+
*/
816+
rotateKeyOnDemand(
817+
args: RotateKeyOnDemandCommandInput,
818+
options?: __HttpHandlerOptions
819+
): Promise<RotateKeyOnDemandCommandOutput>;
820+
rotateKeyOnDemand(
821+
args: RotateKeyOnDemandCommandInput,
822+
cb: (err: any, data?: RotateKeyOnDemandCommandOutput) => void
823+
): void;
824+
rotateKeyOnDemand(
825+
args: RotateKeyOnDemandCommandInput,
826+
options: __HttpHandlerOptions,
827+
cb: (err: any, data?: RotateKeyOnDemandCommandOutput) => void
828+
): void;
829+
784830
/**
785831
* @see {@link ScheduleKeyDeletionCommand}
786832
*/

‎clients/client-kms/src/KMSClient.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ import { ImportKeyMaterialCommandInput, ImportKeyMaterialCommandOutput } from ".
118118
import { ListAliasesCommandInput, ListAliasesCommandOutput } from "./commands/ListAliasesCommand";
119119
import { ListGrantsCommandInput, ListGrantsCommandOutput } from "./commands/ListGrantsCommand";
120120
import { ListKeyPoliciesCommandInput, ListKeyPoliciesCommandOutput } from "./commands/ListKeyPoliciesCommand";
121+
import { ListKeyRotationsCommandInput, ListKeyRotationsCommandOutput } from "./commands/ListKeyRotationsCommand";
121122
import { ListKeysCommandInput, ListKeysCommandOutput } from "./commands/ListKeysCommand";
122123
import { ListResourceTagsCommandInput, ListResourceTagsCommandOutput } from "./commands/ListResourceTagsCommand";
123124
import {
@@ -129,6 +130,7 @@ import { ReEncryptCommandInput, ReEncryptCommandOutput } from "./commands/ReEncr
129130
import { ReplicateKeyCommandInput, ReplicateKeyCommandOutput } from "./commands/ReplicateKeyCommand";
130131
import { RetireGrantCommandInput, RetireGrantCommandOutput } from "./commands/RetireGrantCommand";
131132
import { RevokeGrantCommandInput, RevokeGrantCommandOutput } from "./commands/RevokeGrantCommand";
133+
import { RotateKeyOnDemandCommandInput, RotateKeyOnDemandCommandOutput } from "./commands/RotateKeyOnDemandCommand";
132134
import {
133135
ScheduleKeyDeletionCommandInput,
134136
ScheduleKeyDeletionCommandOutput,
@@ -198,6 +200,7 @@ export type ServiceInputTypes =
198200
| ListAliasesCommandInput
199201
| ListGrantsCommandInput
200202
| ListKeyPoliciesCommandInput
203+
| ListKeyRotationsCommandInput
201204
| ListKeysCommandInput
202205
| ListResourceTagsCommandInput
203206
| ListRetirableGrantsCommandInput
@@ -206,6 +209,7 @@ export type ServiceInputTypes =
206209
| ReplicateKeyCommandInput
207210
| RetireGrantCommandInput
208211
| RevokeGrantCommandInput
212+
| RotateKeyOnDemandCommandInput
209213
| ScheduleKeyDeletionCommandInput
210214
| SignCommandInput
211215
| TagResourceCommandInput
@@ -253,6 +257,7 @@ export type ServiceOutputTypes =
253257
| ListAliasesCommandOutput
254258
| ListGrantsCommandOutput
255259
| ListKeyPoliciesCommandOutput
260+
| ListKeyRotationsCommandOutput
256261
| ListKeysCommandOutput
257262
| ListResourceTagsCommandOutput
258263
| ListRetirableGrantsCommandOutput
@@ -261,6 +266,7 @@ export type ServiceOutputTypes =
261266
| ReplicateKeyCommandOutput
262267
| RetireGrantCommandOutput
263268
| RevokeGrantCommandOutput
269+
| RotateKeyOnDemandCommandOutput
264270
| ScheduleKeyDeletionCommandOutput
265271
| SignCommandOutput
266272
| TagResourceCommandOutput

‎clients/client-kms/src/commands/CreateCustomKeyStoreCommand.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,8 +247,8 @@ export interface CreateCustomKeyStoreCommandOutput extends CreateCustomKeyStoreR
247247
*
248248
* @throws {@link XksProxyUriEndpointInUseException} (client fault)
249249
* <p>The request was rejected because the <code>XksProxyUriEndpoint</code> is already
250-
* associated with another external key store in this Amazon Web Services Region. To identify the cause,
251-
* see the error message that accompanies the exception. </p>
250+
* associated with another external key store in this Amazon Web Services Region. To identify the cause, see
251+
* the error message that accompanies the exception. </p>
252252
*
253253
* @throws {@link XksProxyUriInUseException} (client fault)
254254
* <p>The request was rejected because the concatenation of the <code>XksProxyUriEndpoint</code>

‎clients/client-kms/src/commands/DisableKeyRotationCommand.ts‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,16 @@ export interface DisableKeyRotationCommandOutput extends __MetadataBearer {}
5959
* <a>GetKeyRotationStatus</a>
6060
* </p>
6161
* </li>
62+
* <li>
63+
* <p>
64+
* <a>ListKeyRotations</a>
65+
* </p>
66+
* </li>
67+
* <li>
68+
* <p>
69+
* <a>RotateKeyOnDemand</a>
70+
* </p>
71+
* </li>
6272
* </ul>
6373
* <p>
6474
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.

‎clients/client-kms/src/commands/EnableKeyRotationCommand.ts‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,25 @@ export interface EnableKeyRotationCommandInput extends EnableKeyRotationRequest
2727
export interface EnableKeyRotationCommandOutput extends __MetadataBearer {}
2828

2929
/**
30-
* <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation
30+
* <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable">automatic rotation
3131
* of the key material</a> of the specified symmetric encryption KMS key. </p>
32-
* <p>When you enable automatic rotation of a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS key</a>, KMS
32+
* <p>By default, when you enable automatic rotation of a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS key</a>, KMS
3333
* rotates the key material of the KMS key one year (approximately 365 days) from the enable date
34-
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
35-
* CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
36-
* managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
34+
* and every year thereafter. You can use the optional <code>RotationPeriodInDays</code>
35+
* parameter to specify a custom rotation period when you enable key rotation, or you can use
36+
* <code>RotationPeriodInDays</code> to modify the rotation period of a key that you previously
37+
* enabled automatic key rotation on.</p>
38+
* <p>You can monitor rotation of the key material
39+
* for your KMS keys in CloudTrail and Amazon CloudWatch. To disable rotation of the key
40+
* material in a customer managed KMS key, use the <a>DisableKeyRotation</a>
41+
* operation. You can use the <a>GetKeyRotationStatus</a> operation to identify any in progress
42+
* rotations. You can use the <a>ListKeyRotations</a> operation to view the details of
43+
* completed rotations.</p>
3744
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
3845
* You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
39-
* <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
46+
* <p>You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
4047
* always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
41-
* keys</a> varies.</p>
48+
* keys</a> is managed by the Amazon Web Services service that owns the key.</p>
4249
* <note>
4350
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
4451
* years (approximately 1,095 days) to every year (approximately 365 days).</p>
@@ -67,6 +74,20 @@ export interface EnableKeyRotationCommandOutput extends __MetadataBearer {}
6774
* <a>GetKeyRotationStatus</a>
6875
* </p>
6976
* </li>
77+
* <li>
78+
* <p>
79+
* <a>ListKeyRotations</a>
80+
* </p>
81+
* </li>
82+
* <li>
83+
* <p>
84+
* <a>RotateKeyOnDemand</a>
85+
* </p>
86+
* <note>
87+
* <p>You can perform on-demand (<a>RotateKeyOnDemand</a>) rotation of the
88+
* key material in customer managed KMS keys, regardless of whether or not automatic key rotation is enabled.</p>
89+
* </note>
90+
* </li>
7091
* </ul>
7192
* <p>
7293
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
@@ -79,6 +100,7 @@ export interface EnableKeyRotationCommandOutput extends __MetadataBearer {}
79100
* const client = new KMSClient(config);
80101
* const input = { // EnableKeyRotationRequest
81102
* KeyId: "STRING_VALUE", // required
103+
* RotationPeriodInDays: Number("int"),
82104
* };
83105
* const command = new EnableKeyRotationCommand(input);
84106
* const response = await client.send(command);

‎clients/client-kms/src/commands/GetKeyRotationStatusCommand.ts‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,20 @@ export interface GetKeyRotationStatusCommandInput extends GetKeyRotationStatusRe
2727
export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusResponse, __MetadataBearer {}
2828

2929
/**
30-
* <p>Gets a Boolean value that indicates whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is
31-
* enabled for the specified KMS key.</p>
32-
* <p>When you enable automatic rotation for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>, KMS
33-
* rotates the key material of the KMS key one year (approximately 365 days) from the enable date
34-
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
35-
* CloudTrail and Amazon CloudWatch.</p>
30+
* <p>Provides detailed information about the rotation status for a KMS key, including
31+
* whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is enabled for the specified KMS key, the
32+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotation-period">rotation period</a>, and the next scheduled
33+
* rotation date.</p>
3634
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
3735
* You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
3836
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
3937
* material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
4038
* configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
4139
* key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
40+
* <p>You can perform on-demand (<a>RotateKeyOnDemand</a>) rotation of the
41+
* key material in customer managed KMS keys, regardless of whether or not automatic key rotation is enabled.
42+
* You can use GetKeyRotationStatus to identify the date and time that an in progress on-demand rotation
43+
* was initiated. You can use <a>ListKeyRotations</a> to view the details of completed rotations.</p>
4244
* <note>
4345
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
4446
* years to every year. For details, see <a>EnableKeyRotation</a>.</p>
@@ -79,6 +81,16 @@ export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusR
7981
* <a>EnableKeyRotation</a>
8082
* </p>
8183
* </li>
84+
* <li>
85+
* <p>
86+
* <a>ListKeyRotations</a>
87+
* </p>
88+
* </li>
89+
* <li>
90+
* <p>
91+
* <a>RotateKeyOnDemand</a>
92+
* </p>
93+
* </li>
8294
* </ul>
8395
* <p>
8496
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
@@ -96,6 +108,10 @@ export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusR
96108
* const response = await client.send(command);
97109
* // { // GetKeyRotationStatusResponse
98110
* // KeyRotationEnabled: true || false,
111+
* // KeyId: "STRING_VALUE",
112+
* // RotationPeriodInDays: Number("int"),
113+
* // NextRotationDate: new Date("TIMESTAMP"),
114+
* // OnDemandRotationStartDate: new Date("TIMESTAMP"),
99115
* // };
100116
*
101117
* ```

0 commit comments

Comments
 (0)