AWS cli documentation change

Service: cli · 2025-06-28 · Documentation low

File: cli/latest/reference/kms/verify-mac.md

Summary

Added new examples section demonstrating HMAC verification, updated CLI version reference, and improved documentation structure

Security assessment

Added practical examples for security-related HMAC verification operations. While this improves documentation of security features, there's no evidence of addressing a specific security vulnerability. The examples emphasize proper handling of cryptographic parameters (Base64 encoding, file handling) which reinforces security best practices.

Diff

diff --git a/cli/latest/reference/kms/verify-mac.md b/cli/latest/reference/kms/verify-mac.md
index 1adb92b5c..1bec1321a 100644
--- a//cli/latest/reference/kms/verify-mac.md
+++ b//cli/latest/reference/kms/verify-mac.md
@@ -15 +15 @@
-  * [AWS CLI 2.27.42 Command Reference](../../index.html) »
+  * [AWS CLI 2.27.45 Command Reference](../../index.html) »
@@ -35,0 +36 @@
+    * Examples
@@ -256,0 +258,40 @@ Disable automatically prompt for CLI input parameters.
+## Examples¶
+
+### Note
+
+To use the following examples, you must have the AWS CLI installed and configured. See the [Getting started guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) in the _AWS CLI User Guide_ for more information.
+
+Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See [Using quotation marks with strings](https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-parameters-quoting-strings.html) in the _AWS CLI User Guide_ .
+
+**Example 1: To verify an HMAC**
+
+The following `verify-mac` command verifies an HMAC for a particular message, HMAC KMS keys, and MAC algorithm. A value of ‘true’ in the MacValid value in the response indicates that the HMAC is valid.
+
+In AWS CLI v2, the value of the `message` parameter must be Base64-encoded. Or, you can save the message in a file and use the `fileb://` prefix, which tells the AWS CLI to read binary data from the file.
+
+The MAC that you specify cannot be base64-encoded. For help decoding the MAC that the `generate-mac` command returns, see the `generate-mac` command examples.
+
+Before running this command, replace the example key ID with a valid key ID from your AWS account. The key ID must represent a HMAC KMS key with a key usage of `GENERATE_VERIFY_MAC`.
+    
+    
+    msg=(echo 'Hello World' | base64)
+    
+    aws kms verify-mac \
+        --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
+        --message fileb://Message \
+        --mac-algorithm HMAC_SHA_384 \
+        --mac fileb://ExampleMac
+    
+
+Output:
+    
+    
+    {
+        "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "MacValid": true,
+        "MacAlgorithm": "HMAC_SHA_384"
+    }
+    
+
+For more information about using HMAC KMS keys in AWS KMS, see [HMAC keys in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html) in the _AWS Key Management Service Developer Guide_.
+
@@ -283 +324 @@ MacAlgorithm -> (string)
-  * [AWS CLI 2.27.42 Command Reference](../../index.html) »
+  * [AWS CLI 2.27.45 Command Reference](../../index.html) »