AWS aws-backup medium security documentation change

Service: aws-backup · 2025-04-14 · Security-related medium

File: aws-backup/latest/devguide/security-iam-awsmanpol.md

Summary

Reduced KMS permissions in policy from both Decrypt+GenerateDataKey to only Decrypt

Security assessment

Security improvement through permission reduction (principle of least privilege) by removing GenerateDataKey action from KMS permissions

Diff

diff --git a/aws-backup/latest/devguide/security-iam-awsmanpol.md b/aws-backup/latest/devguide/security-iam-awsmanpol.md
index 4e92173ad..3bb4f57ad 100644
--- a//aws-backup/latest/devguide/security-iam-awsmanpol.md
+++ b//aws-backup/latest/devguide/security-iam-awsmanpol.md
@@ -280,4 +280 @@ This policy’s version defines the permissions for the policy. When the user or
-                "Action": [
-                    "kms:Decrypt",
-                    "kms:GenerateDataKey"
-                ],
+                "Action": "kms:Decrypt",