AWS AWSCloudFormation documentation change
Summary
Updated KMS documentation links, clarified encryption limitations for customer managed keys, added guidance about archive encryption alignment with event bus keys, and introduced field pattern validation
Security assessment
The changes enhance documentation about encryption practices (customer managed keys vs AWS owned keys) and add recommendations for encrypting archives. While security-related documentation is added, there's no evidence this addresses a specific vulnerability or security incident.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.md b/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.md index 0686612f4..a782c3f3a 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.md +++ b//AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.md @@ -102 +102 @@ If you do not specify a customer managed key identifier, EventBridge uses an AWS -For more information, see [Managing keys](https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html) in the _AWS Key Management Service Developer Guide_. +For more information, see [Identify and view keys](https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html) in the _AWS Key Management Service Developer Guide_. @@ -106,3 +106 @@ For more information, see [Managing keys](https://docs.aws.amazon.com/kms/latest -Archives and schema discovery are not supported for event buses encrypted using a customer managed key. EventBridge returns an error if: - - * You call ` [CreateArchive](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateArchive.html) ` on an event bus set to use a customer managed key for encryption. +Schema discovery is not supported for event buses encrypted using a customer managed key. EventBridge returns an error if: @@ -112 +110,3 @@ Archives and schema discovery are not supported for event buses encrypted using - * You call ` [UpdatedEventBus](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdatedEventBus.html) ` to set a customer managed key on an event bus with an archives or schema discovery enabled. + * You call ` [UpdatedEventBus](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdatedEventBus.html) ` to set a customer managed key on an event bus with schema discovery enabled. + + @@ -114,0 +115 @@ Archives and schema discovery are not supported for event buses encrypted using +To enable schema discovery on an event bus, choose to use an AWS owned key. For more information, see [Encrypting events](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-encryption-event-bus-cmkey.html) in the _Amazon EventBridge User Guide_. @@ -115,0 +117 @@ Archives and schema discovery are not supported for event buses encrypted using +###### Important @@ -117 +119,3 @@ Archives and schema discovery are not supported for event buses encrypted using -To enable archives or schema discovery on an event bus, choose to use an AWS owned key. For more information, see [Data encryption in EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-encryption.html) in the _Amazon EventBridge User Guide_. +If you have specified that EventBridge use a customer managed key for encrypting the source event bus, we strongly recommend you also specify a customer managed key for any archives for the event bus as well. + +For more information, see [Encrypting archives](https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-archives.html) in the _Amazon EventBridge User Guide_. @@ -122,0 +127,2 @@ _Required_ : No + _Pattern_ : `^[a-zA-Z0-9_\-/:]*$` +