AWS aws-backup medium security documentation change

Service: aws-backup · 2025-05-13 · Security-related medium

File: aws-backup/latest/devguide/security-iam-awsmanpol.md

Summary

Removed the kms:GenerateDataKey permission from the AWSBackupServiceRolePolicyForItemRestores managed policy.

Security assessment

Removing the kms:GenerateDataKey permission reduces over-privileged access, addressing a potential security risk of unnecessary cryptographic key generation capabilities.

Diff

diff --git a/aws-backup/latest/devguide/security-iam-awsmanpol.md b/aws-backup/latest/devguide/security-iam-awsmanpol.md
index 4e92173ad..4533967ad 100644
--- a//aws-backup/latest/devguide/security-iam-awsmanpol.md
+++ b//aws-backup/latest/devguide/security-iam-awsmanpol.md
@@ -281,2 +281 @@ This policy’s version defines the permissions for the policy. When the user or
-                    "kms:Decrypt",
-                    "kms:GenerateDataKey"
+                    "kms:Decrypt"