UpdatePrimaryRegion - AWS Key Management Service

UpdatePrimaryRegion

The following example shows the AWS CloudTrail log entries that are generated by calling the UpdatePrimaryRegion operation on a multi-Region key.

The UpdatePrimaryRegion operation writes two CloudTrail log entries: one in the Region with the multi-Region primary key that is converted to a replica key, and one in the Region with a multi-Region replica key that is converted to a primary key.

The following example shows a CloudTrail log entry for UpdatePrimaryRegion in the Region where the multi-Region key changed from a primary key to a replica key (us-west-2). The primaryRegion field shows the Region that now hosts the primary key (ap-northeast-1).

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2021-03-10T20:23:37Z", "eventSource": "kms.amazonaws.com", "eventName": "UpdatePrimaryRegion", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.0", "userAgent": "AWS Internal", "requestParameters": { "keyId": "mrk-1234abcd12ab34cd56ef1234567890ab", "primaryRegion": "ap-northeast-1" }, "responseElements": null, "requestID": "ee408f36-ea01-422b-ac14-b0f147c68334", "eventID": "3c4226b0-1e81-48a8-a333-7fa5f3cbd118", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab" } ], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111122223333" }

The following example represents the CloudTrail log entry for UpdatePrimaryRegion in the Region where the multi-Region key changed from a replica key to a primary key (ap-northeast-1). This log entry doesn't identify the previous primary Region.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "invokedBy": "kms.amazonaws.com" }, "eventTime": "2021-03-10T20:23:37Z", "eventSource": "kms.amazonaws.com", "eventName": "UpdatePrimaryRegion", "awsRegion": "ap-northeast-1", "sourceIPAddress": "192.0.2.0", "userAgent": "AWS Internal", "requestParameters": { "keyId": "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab", "primaryRegion": "ap-northeast-1" }, "responseElements": null, "requestID": "ee408f36-ea01-422b-ac14-b0f147c68334", "eventID": "091e6be5-737f-43c6-8431-e3679d6d0619", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111122223333" }