AWS datazone high security documentation change

Service: datazone · 2025-05-31 · Security-related high

File: datazone/latest/userguide/quickstart-glue.md

Summary

Updated KMS policy with specific key ARN and action ordering

Security assessment

Replaced wildcard resource with specific KMS key ARN and reordered actions, implementing least privilege access control for encryption keys

Diff

diff --git a/datazone/latest/userguide/quickstart-glue.md b/datazone/latest/userguide/quickstart-glue.md
index b9045a5c9..09ecdc060 100644
--- a//datazone/latest/userguide/quickstart-glue.md
+++ b//datazone/latest/userguide/quickstart-glue.md
@@ -63,0 +64 @@ For more information about using customer managed keys, see [Data encryption at
+              "Sid": "Statement1",
@@ -66,0 +68 @@ For more information about using customer managed keys, see [Data encryption at
+                "kms:DescribeKey",
@@ -69 +71,3 @@ For more information about using customer managed keys, see [Data encryption at
-              "Resource": "*"
+              "Resource": [
+                "arn:<partition>:kms:<region>:<account-id>:key/<key-id>"
+              ]