{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T13:36:43.315Z",
  "record_id": "VXI-EXT-PROCUREMENT-KMS-DISABLE-DATAKEY-01-v1",
  "record_kind": "external_reference",
  "title": "KMS disablement: Existing data keys and access",
  "system": "AWS KMS",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does disabling a KMS key immediately stop every read of the protected data?",
  "near_questions": [
    "Can a cached data key outlive KMS disablement?",
    "When does the service next call KMS?",
    "Is the key customer managed?",
    "Does eventual consistency affect the transition?",
    "Does disabling erase the key material?",
    "Can the key be enabled again?",
    "Does the application retain plaintext?",
    "Which resources use this key?",
    "Does one failed decrypt prove all access ended?",
    "Are other copies protected differently?",
    "What evidence supports a revocation claim?",
    "Can I save the data-key boundary?"
  ],
  "supported_claims": [
    {
      "claim": "Disabled customer-managed keys cannot perform KMS cryptographic operations, subject to eventual consistency. Resources already using data keys are not affected until they need KMS again, for example to decrypt a data key. Disabling the parent key is not evidence that every application has discarded plaintext or cached key material.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Disabled customer-managed keys cannot perform KMS cryptographic operations, subject to eventual consistency. Resources already using data keys are not affected until they need KMS again, for example to decrypt a data key. Disabling the parent key is not evidence that every application has discarded plaintext or cached key material.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "AWS KMS enabling and disabling keys",
    "source_url": "https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-KMS-DISABLE-DATAKEY-01-v1",
    "candidate_record_sha256": "422a0be5aa18288c72a68431037942ee121b50e40f6be128d1077e3ec78b84a4",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Disabled customer-managed keys cannot perform KMS cryptographic operations, subject to eventual consistency. Resources already using data keys are not affected until they need KMS again, for example to decrypt a data key. Disabling the parent key is not evidence that every application has discarded plaintext or cached key material.",
    "required_buyer_context": "Key type, service, data-key caching, transition time and retained copies. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Disabling the KMS key immediately revokes all access to every protected resource.",
    "documented_statement": {
      "status": "documented",
      "statement": "Disabled customer-managed keys cannot perform KMS cryptographic operations, subject to eventual consistency. Resources already using data keys are not affected until they need KMS again, for example to decrypt a data key. Disabling the parent key is not evidence that every application has discarded plaintext or cached key material.",
      "source_ids": [
        "kms"
      ]
    },
    "buyer_evidence_required": [
      "Key state and change time.",
      "Service use of data keys and caching.",
      "Observed application access and retained plaintext scope."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Check the consuming service and cached material before claiming immediate universal revocation."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "kms",
        "url": "https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html",
        "final_url": "https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html",
        "title": "AWS KMS enabling and disabling keys",
        "checked_on": "2026-10-16",
        "sha256": "dc1b158afe2ceec65e63bf7b4df77f8ecd8a6556f67bad7a5eae2f841045f823",
        "bytes": 17221
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the distinction between a KMS state change and effective application access.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Key type, service, data-key caching, transition time and retained copies."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#kms-disable-cached-data-key-boundary",
  "machine_readable_record": "/varexis-index/records/kms-disable-cached-data-key-boundary.json"
}