AWS eventbridge medium security documentation change
Summary
Updated AmazonEventBridgeApiDestinationsServiceRolePolicy to include KMS encrypt/decrypt permissions for Secrets Manager. Updated policy reference labels for consistency.
Security assessment
Explicitly added KMS permissions to enable secure handling of OAuth token refresh in Secrets Manager, addressing potential encryption capability gaps.
Diff
diff --git a/eventbridge/latest/userguide/eb-document-history.md b/eventbridge/latest/userguide/eb-document-history.md index 505899f6e..ca6d3ac3b 100644 --- a//eventbridge/latest/userguide/eb-document-history.md +++ b//eventbridge/latest/userguide/eb-document-history.md @@ -8,0 +9,5 @@ Change | Description | Release Date +Updated AmazonEventBridgeApiDestinationsServiceRolePolicy managed policy | Policy now grants EventBridge AWS KMS encrypt and decrypt permissions via Secrets Manager. This enables EventBridge to update connection secret resources with new OAuth token value when access token refresh is required. + + * [Amazon EventBridge updates to AWS managed policies](./eb-use-identity-based.html#eb-use-identity-based-awsmanpol-updates) + +| March 28, 2025 @@ -32 +37 @@ Added the AmazonEventBridgePipesFullAccess policy. | Provides full access to Am - * [EventBridge Pipes-specific managed policies](./eb-use-identity-based.html#eb-pipes-access-policies) + * [AWS managed policies: EventBridge Pipes](./eb-use-identity-based.html#eb-pipes-access-policies) @@ -37 +42 @@ Added the AmazonEventBridgePipesReadOnlyAccess policy. | Provides read-only acc - * [EventBridge Pipes-specific managed policies](./eb-use-identity-based.html#eb-pipes-access-policies) + * [AWS managed policies: EventBridge Pipes](./eb-use-identity-based.html#eb-pipes-access-policies) @@ -42 +47 @@ Added the AmazonEventBridgePipesOperatorAccess policy. | Provides read-only and - * [EventBridge Pipes-specific managed policies](./eb-use-identity-based.html#eb-pipes-access-policies) + * [AWS managed policies: EventBridge Pipes](./eb-use-identity-based.html#eb-pipes-access-policies) @@ -47 +52 @@ Updated the CloudWatchEventsFullAccess policy. | Updated to match `AmazonEventB - * [AmazonEventBridgeFullAccess policy](./eb-use-identity-based.html#eb-full-access-policy) + * [AWS managed policy: AmazonEventBridgeFullAccess](./eb-use-identity-based.html#eb-full-access-policy) @@ -52 +57 @@ Updated the CloudWatchEventsReadOnlyAccess policy. | Updated to match `AmazonEv - * [AmazonEventBridgeReadOnlyAccess policy](./eb-use-identity-based.html#eb-read-only-access-policy) + * [AWS managed policy: AmazonEventBridgeReadOnlyAccess](./eb-use-identity-based.html#eb-read-only-access-policy) @@ -62 +67 @@ Updated the AmazonEventBridgeFullAccess policy. | Added permissions necessary f - * [AmazonEventBridgeFullAccess policy](./eb-use-identity-based.html#eb-full-access-policy) + * [AWS managed policy: AmazonEventBridgeFullAccess](./eb-use-identity-based.html#eb-full-access-policy) @@ -67 +72 @@ Updated the AmazonEventBridgeReadOnlyAccess policy. | You can now view EventBri - * [AmazonEventBridgeReadOnlyAccess policy](./eb-use-identity-based.html#eb-read-only-access-policy) + * [AWS managed policy: AmazonEventBridgeReadOnlyAccess](./eb-use-identity-based.html#eb-read-only-access-policy) @@ -77 +82 @@ Updated the AmazonEventBridgeFullAccess policy. | Added permissions necessary f - * [AmazonEventBridgeFullAccess policy](./eb-use-identity-based.html#eb-full-access-policy) + * [AWS managed policy: AmazonEventBridgeFullAccess](./eb-use-identity-based.html#eb-full-access-policy) @@ -82 +87 @@ Updated the AmazonEventBridgeReadOnlyAccess policy. | You can now view EventBri - * [AmazonEventBridgeReadOnlyAccess policy](./eb-use-identity-based.html#eb-read-only-access-policy) + * [AWS managed policy: AmazonEventBridgeReadOnlyAccess](./eb-use-identity-based.html#eb-read-only-access-policy) @@ -87 +92 @@ Updated the AmazonEventBridgeReadOnlyAccess policy. | You can now view endpoint - * [AmazonEventBridgeReadOnlyAccess policy](./eb-use-identity-based.html#eb-read-only-access-policy) + * [AWS managed policy: AmazonEventBridgeReadOnlyAccess](./eb-use-identity-based.html#eb-read-only-access-policy)