AWS controltower documentation change
Summary
Updated KMS key policy examples to use 'arn:PARTITION' instead of 'arn:aws' in resource ARNs and condition keys
Security assessment
The changes standardize ARN formats by replacing hardcoded 'aws' partition with a placeholder variable. This improves documentation accuracy for multi-partition compatibility (e.g., GovCloud, China regions) but does not address security vulnerabilities or add new security features. The policy logic and permissions remain unchanged.
Diff
diff --git a/controltower/latest/userguide/configure-kms-keys.md b/controltower/latest/userguide/configure-kms-keys.md index 8b5bf9507..d0e519a13 100644 --- a//controltower/latest/userguide/configure-kms-keys.md +++ b//controltower/latest/userguide/configure-kms-keys.md @@ -122 +122 @@ The following example policy shows what your KMS key policy might look like afte - "Resource": "arn:aws:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID" + "Resource": "arn:PARTITION:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID" @@ -134 +134 @@ The following example policy shows what your KMS key policy might look like afte - "Resource": "arn:aws:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID", + "Resource": "arn:PARTITION:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID", @@ -137 +137 @@ The following example policy shows what your KMS key policy might look like afte - "aws:SourceArn": "arn:aws:cloudtrail:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:trail/aws-controltower-BaselineCloudTrail" + "aws:SourceArn": "arn:PARTITION:cloudtrail:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:trail/aws-controltower-BaselineCloudTrail" @@ -140 +140 @@ The following example policy shows what your KMS key policy might look like afte - "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:YOUR-MANAGEMENT-ACCOUNT-ID:trail/*" + "kms:EncryptionContext:aws:cloudtrail:arn": "arn:PARTITION:cloudtrail:*:YOUR-MANAGEMENT-ACCOUNT-ID:trail/*"