AWS guardduty documentation change
Summary
Added clarification about GuardDuty's handling of CSE-KMS encrypted objects and scanning behavior
Security assessment
The change provides additional documentation about security feature limitations (handling of client-side encrypted objects) but does not indicate a security vulnerability being fixed. It enhances understanding of existing security controls.
Diff
diff --git a/guardduty/latest/ug/supported-s3-features-malware-protection-s3.md b/guardduty/latest/ug/supported-s3-features-malware-protection-s3.md index 2d5256457..6ef3de6af 100644 --- a//guardduty/latest/ug/supported-s3-features-malware-protection-s3.md +++ b//guardduty/latest/ug/supported-s3-features-malware-protection-s3.md @@ -28 +28,5 @@ Data Encryption - SSE-C | No | Malware Protection for S3 doesn't support scann -Client side encryption | No | When your S3 objects are encrypted by using Amazon S3 Encryption Client, your objects aren't exposed to any third party, including AWS. For more information about why this is not supported, see [Protecting data by using client-side encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html) in the _Amazon S3 User Guide_. +Client side encryption | No | When your Amazon S3 objects are encrypted by using Amazon S3 Encryption Client, your objects aren't exposed to any third party, including AWS. For information on why this is not supported, see [Protecting data by using client-side encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html). + +###### Note + +CSE-KMS encrypted objects are received as an encrypted blob where the encryption can't be determined. Therefore, GuardDuty processes them as they are received, and scans the encrypted blob as a regular file. GuardDuty doesn''t return an `UNSUPPORTED` scan status for such objects, unless any of the [Quotas in Malware Protection for S3](./malware-protection-s3-quotas-guardduty.html) exceeds.