AWS datasync documentation change

Service: datasync · 2025-04-18 · Documentation low

File: datasync/latest/userguide/security-iam-awsmanpol.md

Summary

Updated AWSDataSyncFullAccess policy documentation to include Secrets Manager and KMS permissions, added changelog entries detailing new secret/key management capabilities.

Security assessment

Expands documentation about security-related permissions for secrets and encryption management without referencing a specific security issue.

Diff

diff --git a/datasync/latest/userguide/security-iam-awsmanpol.md b/datasync/latest/userguide/security-iam-awsmanpol.md
index 504b3bd1d..d0c83bc60 100644
--- a//datasync/latest/userguide/security-iam-awsmanpol.md
+++ b//datasync/latest/userguide/security-iam-awsmanpol.md
@@ -50 +50 @@ You can attach the `AWSDataSyncFullAccess` policy to your IAM identities.
-This policy grants administrative permissions for DataSync and is required for AWS Management Console access to the service. `AWSDataSyncFullAccess` provides full access to DataSync API operations and the operations that describe related resources (such as Amazon S3 buckets and Amazon EFS file systems). The policy also grants permissions for Amazon CloudWatch, including creating log groups and creating or updating a resource policy.
+This policy grants administrative permissions for DataSync and is required for AWS Management Console access to the service. `AWSDataSyncFullAccess` provides full access to DataSync API operations and the operations that describe related resources (such as Amazon S3 buckets, Amazon EFS file systems, AWS KMS keys, and Secrets Manager secrets). The policy also grants permissions for Amazon CloudWatch, including creating log groups and creating or updating a resource policy.
@@ -85 +85,4 @@ This policy grants administrative permissions for DataSync and is required for A
-                    "s3-outposts:ListRegionalBuckets"
+                    "s3-outposts:ListRegionalBuckets",
+                    "secretsmanager:ListSecrets",
+                    "kms:ListAliases",
+                    "kms:DescribeKey"
@@ -133,0 +137,13 @@ Change | Description | Date
+AWSDataSyncFullAccess – Change |  DataSync added new permissions to `AWSDataSyncFullAccess`: 
+
+  * `secretsmanager:ListSecrets`
+  * `kms:ListAliases`
+  * `kms:DescribeKey`
+
+These permissions let DataSync retrieve metadata about your AWS Secrets Manager secrets and AWS KMS keys, including any aliases associated with your keys. | April 23, 2025  
+AWSDataSyncServiceRolePolicy – Change |  DataSync added new permissions to the `AWSDataSyncServiceRolePolicy` policy that's used by the DataSync service-linked role `AWSServiceRoleForDataSync`:
+
+  * `secretsmanager:DescribeSecret`
+  * `secretsmanager:GetSecretValue`
+
+These permissions let DataSync read metadata and values for secrets managed by AWS Secrets Manager. | April 15, 2025