AWS iot-fleetwise high security documentation change

Service: iot-fleetwise · 2025-02-27 · Security-related high

File: iot-fleetwise/latest/developerguide/key-management.md

Summary

Added new section 'Recovery after AWS KMS key deletion' with detailed cleanup procedure

Security assessment

The change addresses a security-related scenario involving KMS key deletion and provides guidance on secure cleanup procedures to maintain data integrity

Diff

diff --git a/iot-fleetwise/latest/developerguide/key-management.md
index c696febe7..f9503df1f 100644
--- a/iot-fleetwise/latest/developerguide/key-management.md
+++ b/iot-fleetwise/latest/developerguide/key-management.md
@@ -5 +5 @@
-AWS IoT FleetWise cloud key managementEnable encryption using KMS keys (console)Enable encryption using KMS keys (AWS CLI)KMS key policyPermissions for AWS KMS encryption 
+AWS IoT FleetWise cloud key managementEnable encryption using KMS keys (console)Enable encryption using KMS keys (AWS CLI)KMS key policyPermissions for AWS KMS encryption Recovery after AWS KMS key deletion
@@ -210,0 +211,60 @@ The following policy statement is required for your role to invoke encryption AP
+## Recovery after AWS KMS key deletion
+
+If you delete an AWS KMS key after enabling encryption with AWS IoT FleetWise, you must reset your account by deleting all data before using AWS IoT FleetWise again. You can use the list and delete API operations to clean up resources in your account. 
+
+###### To clean up resources in your account
+
+  1. Use list APIs with the `listResponseScope` parameter set to `METADATA_ONLY`. This provides a list of resources, including resource names and other metadata such as ARNs and timestamps.
+
+  2. Use delete APIs to remove individual resources.
+
+
+
+
+You must clean up resources in the following order.
+
+  1. Campaigns
+
+    1. List all campaigns with the `listResponseScope` parameter set to `METADATA_ONLY`.
+
+    2. Delete the campaigns.
+
+  2. Fleets and vehicles
+
+    1. List all fleets with the `listResponseScope` parameter set to `METADATA_ONLY`.
+
+    2. List all vehicles for each fleet with the `listResponseScope` parameter set to `METADATA_ONLY`.
+
+    3. Disassociate all vehicles from each fleet.
+
+    4. Delete the fleets.
+
+    5. Delete the vehicles.
+
+  3. Decoder manifests
+
+    1. List all decoder manifests with the `listResponseScope` parameter set to `METADATA_ONLY`.
+
+    2. Delete all decoder manifests.
+
+  4. Vehicle models (model manifests)
+
+    1. List all vehicle models with the `listResponseScope` parameter set to `METADATA_ONLY`.
+
+    2. Delete all vehicle models.
+
+  5. State templates
+
+    1. List all state templates with the `listResponseScope` parameter set to `METADATA_ONLY`.
+
+    2. Delete all state templates.
+
+  6. Signal catalogs
+
+    1. List all signal catalogs.
+
+    2. Delete all signal catalogs.
+
+
+
+