Review KMS alias changes as changes to future key selection

Keep the logical alias distinct from the key resource behind it.

Source facts

A KMS alias is an independent resource associated with one key at a time in the same account and Region. Updating or deleting the alias does not alter the associated key. The same alias name can identify different Regional keys, and an IAM policy naming an alias resource refers to the alias itself.

Source: AWS Documentation.

Applicability

This applies to KMS alias administration and application key selection, rather than automatic rotation of material within one key.

DSE recommendation

DSE recommends recording both the alias and resolved key ARN before a change. Identify applications and policies that use the alias, and document which future operations should select the new key. Preserve access to earlier keys for data that still depends on them. Review alias administration as an authorization-sensitive task where aliases influence access conditions. Avoid describing a repoint operation as a migration of existing ciphertext; plan any required data migration separately with the data owner. Put the old and new target identifiers in the approval and state which new writes should change key selection. Require a separate decision for retiring the old key, supported by its own dependency review instead of treating a successful alias update as retirement evidence.

Verification

Proposed verification: resolve the alias before and after an approved test change, exercise new encryption with disposable data, and check recovery of data created under the prior key. Confirm that identically named aliases in other Regions resolve to their intended independent targets.

Official reference

AWS Documentation. Reviewed October 20, 2026.