feat(kms): bulk DEK rekey sweep with admin API and kms:Rekey action (#6654)

crates/policy/src/policy/action.rs

@@ -712,6 +712,12 @@ pub enum KmsAction {
     /// Preflight or execute a KMS restore.
     #[strum(serialize = "kms:Restore")]
     RestoreAction,
+    /// Run the bulk rekey sweep that rewraps stored object DEK envelopes onto
+    /// current master key versions. Cluster-scoped: it walks and rewrites
+    /// object metadata across buckets, so it is never conferred by a per-key
+    /// role template.
+    #[strum(serialize = "kms:Rekey")]
+    RekeyAction,
 }
 
 #[cfg(test)]
@@ -754,6 +760,7 @@ mod tests {
             ("kms:Decrypt", KmsAction::DecryptAction),
             ("kms:Backup", KmsAction::BackupAction),
             ("kms:Restore", KmsAction::RestoreAction),
+            ("kms:Rekey", KmsAction::RekeyAction),
         ] {
             let action = Action::try_from(raw).expect("Should parse KMS action");
             assert_eq!(action, Action::KmsAction(expected));

crates/policy/src/policy/policy.rs

@@ -854,13 +854,14 @@ mod test {
 
     /// Actions that act on the service or on every key's material at once. No role
     /// template may confer them.
-    const KMS_CLUSTER_ADMIN_ACTIONS: [KmsAction; 6] = [
+    const KMS_CLUSTER_ADMIN_ACTIONS: [KmsAction; 7] = [
         KmsAction::AllActions,
         KmsAction::ConfigureAction,
         KmsAction::ServiceControlAction,
         KmsAction::ClearCacheAction,
         KmsAction::BackupAction,
         KmsAction::RestoreAction,
+        KmsAction::RekeyAction,
     ];
 
     const KMS_ROLE_TEMPLATES: [&str; 3] = [default::KMS_KEY_ADMINISTRATOR, default::KMS_KEY_USER, default::KMS_AUDITOR];