AWS AWSCloudFormation documentation change
Summary
Updated encryption guidance to recommend consistent use of customer managed keys for archives
Security assessment
Enhances documentation about encryption best practices but does not indicate a resolved vulnerability
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-events-archive.md b/AWSCloudFormation/latest/UserGuide/aws-resource-events-archive.md index b51b80d0d..8fa1719c1 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-resource-events-archive.md +++ b//AWSCloudFormation/latest/UserGuide/aws-resource-events-archive.md @@ -9 +9 @@ Creates an archive of events with the specified settings. When you create an arc -###### Note +###### Important @@ -11 +11 @@ Creates an archive of events with the specified settings. When you create an arc -Archives and schema discovery are not supported for event buses encrypted using a customer managed key. EventBridge returns an error if: +If you have specified that EventBridge use a customer managed key for encrypting the source event bus, we strongly recommend you also specify a customer managed key for any archives for the event bus as well. @@ -13,10 +13 @@ Archives and schema discovery are not supported for event buses encrypted using - * You call ` [CreateArchive](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateArchive.html) ` on an event bus set to use a customer managed key for encryption. - - * You call ` [CreateDiscoverer](https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers.html#CreateDiscoverer) ` on an event bus set to use a customer managed key for encryption. - - * You call ` [UpdatedEventBus](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdatedEventBus.html) ` to set a customer managed key on an event bus with an archives or schema discovery enabled. - - - - -To enable archives or schema discovery on an event bus, choose to use an AWS owned key. For more information, see [Data encryption in EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-encryption.html) in the _Amazon EventBridge User Guide_. +For more information, see [Encrypting archives](https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-archives.html) in the _Amazon EventBridge User Guide_. @@ -123,0 +115,2 @@ _Required_ : Yes + _Pattern_ : `^arn:aws([a-z]|\-)*:events:([a-z]|\d|\-)*:([0-9]{12})?:.+\/.+$` +