AWS healthimaging documentation change
Summary
Updated KMS permissions requirements, expanded IAM policy example, and added detailed grant configuration examples with specific key operations and constraints
Security assessment
The changes provide more granular KMS permission requirements and concrete policy examples for encryption operations. While this improves security documentation clarity, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/healthimaging/latest/devguide/data-encryption.md b/healthimaging/latest/devguide/data-encryption.md index 70284f3af..18b8cda80 100644 --- a//healthimaging/latest/devguide/data-encryption.md +++ b//healthimaging/latest/devguide/data-encryption.md @@ -58 +58,2 @@ The following is a policy statement example that allows a user to create and int - "kms:GenerateDataKey*" + "kms:GenerateDataKey", + "kms:GenerateDataKeyWithoutPlaintext" @@ -76 +77,19 @@ For more information about key policies, see [ Enabling IAM policies](https://do -The IAM user, IAM role, or AWS account creating your repositories must have permissions for `kms:CreateGrant`, `kms:GenerateDataKey`, `kms:RetireGrant`, `kms:Decrypt`, and `kms:ReEncrypt*`, plus the necessary permissions for AWS HealthImaging. +The IAM user, IAM role, or AWS account creating your repositories must have permissions for the policy below, plus the necessary permissions for AWS HealthImaging. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "kms:CreateGrant", + "kms:GenerateDataKey", + "kms:RetireGrant", + "kms:Decrypt", + "kms:ReEncrypt*", + "Resource": "arn:aws:kms:us-east-1:123456789012:key/bec71d48-3462-4cdd-9514-77a7226e001f" + } + ] + } + @@ -96,2 +115,7 @@ Users are not required to create their own grants. HealthImaging creates a grant - "Grants": [ - { + "KeyId": "arn:aws:kms:us-east-1:147997158357:key/8e1c34df-5fd2-49fa-8986-4618c9829a8c", + "GrantId": "44e88bc45b769499ce5ec4abd5ecb27eeb3b178a4782452aae65fe885ee5ba20", + "Name": "MedicalImagingGrantForQIDO_ebff634a-2d16-4046-9238-e3dc4ab54d29", + "CreationDate": "2025-04-17T20:12:49+00:00", + "GranteePrincipal": "AWS Internal", + "RetiringPrincipal": "medical-imaging.us-east-1.amazonaws.com", + "IssuingAccount": "medical-imaging.us-east-1.amazonaws.com", @@ -102,0 +127,4 @@ Users are not required to create their own grants. HealthImaging creates a grant + "ReEncryptFrom", + "ReEncryptTo", + "CreateGrant", + "RetireGrant", @@ -104,13 +132 @@ Users are not required to create their own grants. HealthImaging creates a grant - ], - "KeyId": "arn:aws:kms:us-west-2:824333766656:key/2fe3c119-792d-4b99-822f-b5841e1181d1", - "Name": "0a74e6ad2aa84b74a22fcd3efac1eaa8", - "RetiringPrincipal": "AWS Internal", - "GranteePrincipal": "AWS Internal", - "GrantId": "0da169eb18ffd3da8c0eebc9e74b3839573eb87e1e0dce893bb544a34e8fbaaf", - "IssuingAccount": "AWS Internal", - "CreationDate": 1685050229.0, - "Constraints": { - "EncryptionContextSubset": { - "kms-arn": "arn:aws:kms:us-west-2:824333766656:key/2fe3c119-792d-4b99-822f-b5841e1181d1" - } - } + ] @@ -118,0 +135,7 @@ Users are not required to create their own grants. HealthImaging creates a grant + "KeyId": "arn:aws:kms:us-east-1:147997158357:key/8e1c34df-5fd2-49fa-8986-4618c9829a8c", + "GrantId": "9e5fd5ba7812daf75be4a86efb2b1920d6c0c9c0b19781549556bf2ff98953a1", + "Name": "2025-04-17T20:12:38", + "CreationDate": "2025-04-17T20:12:38+00:00", + "GranteePrincipal": "medical-imaging.us-east-1.amazonaws.com", + "RetiringPrincipal": "medical-imaging.us-east-1.amazonaws.com", + "IssuingAccount": "AWS Internal", @@ -119,0 +143,2 @@ Users are not required to create their own grants. HealthImaging creates a grant + "Decrypt", + "Encrypt", @@ -120,0 +146,3 @@ Users are not required to create their own grants. HealthImaging creates a grant + "GenerateDataKeyWithoutPlaintext", + "ReEncryptFrom", + "ReEncryptTo", @@ -124,4 +152,7 @@ Users are not required to create their own grants. HealthImaging creates a grant - ], - "KeyId": "arn:aws:kms:us-west-2:824333766656:key/2fe3c119-792d-4b99-822f-b5841e1181d1", - "Name": "2023-05-25T21:30:17", - "RetiringPrincipal": "AWS Internal", + ] + }, + { + "KeyId": "arn:aws:kms:us-east-1:147997158357:key/8e1c34df-5fd2-49fa-8986-4618c9829a8c", + "GrantId": "ab4a9b919f6ca8eb2bd08ee72475658ee76cfc639f721c9caaa3a148941bcd16", + "Name": "9d060e5b5d4144a895e9b24901088ca5", + "CreationDate": "2025-04-17T20:12:39+00:00", @@ -129,3 +160,15 @@ Users are not required to create their own grants. HealthImaging creates a grant - "GrantId": "8229757abbb2019555ba64d200278cedac08e5a7147426536fcd1f4270040a31", - "IssuingAccount": "AWS Internal", - "CreationDate": 1685050217.0, + "RetiringPrincipal": "medical-imaging.us-east-1.amazonaws.com", + "IssuingAccount": "medical-imaging.us-east-1.amazonaws.com", + "Operations": [ + "Decrypt", + "Encrypt", + "GenerateDataKey", + "GenerateDataKeyWithoutPlaintext", + "ReEncryptFrom", + "ReEncryptTo", + "DescribeKey" + ], + "Constraints": { + "EncryptionContextSubset": { + "kms-arn": "arn:aws:kms:us-east-1:147997158357:key/8e1c34df-5fd2-49fa-8986-4618c9829a8c" + } @@ -133 +175,0 @@ Users are not required to create their own grants. HealthImaging creates a grant - ]