AWS datazone high security documentation change

Service: datazone · 2025-05-31 · Security-related high

File: datazone/latest/userguide/quickstart-rs.md

Summary

Updated KMS policy with specific key ARN and action ordering

Security assessment

Replaced wildcard resource with specific KMS key ARN and added DescribeKey permission, enforcing precise access controls for encryption operations

Diff

diff --git a/datazone/latest/userguide/quickstart-rs.md b/datazone/latest/userguide/quickstart-rs.md
index c8a5a2b79..202213b27 100644
--- a//datazone/latest/userguide/quickstart-rs.md
+++ b//datazone/latest/userguide/quickstart-rs.md
@@ -61,0 +62 @@ For more information about using customer managed keys, see [Data encryption at
+              "Sid": "Statement1",
@@ -64,0 +66 @@ For more information about using customer managed keys, see [Data encryption at
+                "kms:DescribeKey",
@@ -67 +69,3 @@ For more information about using customer managed keys, see [Data encryption at
-              "Resource": "*"
+              "Resource": [
+                "arn:<partition>:kms:<region>:<account-id>:key/<key-id>"
+              ]