AWS datazone high security documentation change

Service: datazone · 2025-03-30 · Security-related high

File: datazone/latest/userguide/create-domain.md

Summary

Changed KMS key resource from wildcard (*) to specific ARN pattern in encryption configuration

Security assessment

Fixes over-permissive wildcard resource specification in KMS policy, enforcing explicit key access

Diff

diff --git a/datazone/latest/userguide/create-domain.md b/datazone/latest/userguide/create-domain.md
index 4edae99c0..e6e931ae8 100644
--- a/datazone/latest/userguide/create-domain.md
+++ b/datazone/latest/userguide/create-domain.md
@@ -43 +43 @@ For more information about using customer managed keys, see [Data encryption at
-                "*"
+                "arn:<partition>:kms:<region>:<account-id>:key/<key-id>"