AWS managedservices medium security documentation change

Service: managedservices · 2025-07-01 · Security-related medium

File: managedservices/latest/userguide/defaults-instance-profile.md

Summary

Updated KMS key ARN pattern from specific alias to wildcard 'key/*' in Trend Cloud One Decryption Key policy

Security assessment

The change expands KMS decryption permissions from a specific alias to any KMS key ('key/*'), potentially increasing attack surface by reducing least-privilege access. This could allow unintended decryption of other keys if misconfigured.

Diff

diff --git a/managedservices/latest/userguide/defaults-instance-profile.md b/managedservices/latest/userguide/defaults-instance-profile.md
index 0bb5fbdc0..bafa6a400 100644
--- a//managedservices/latest/userguide/defaults-instance-profile.md
+++ b//managedservices/latest/userguide/defaults-instance-profile.md
@@ -62 +62 @@ Explicitly Deny List Bucket S3 | Deny | ListBucket | Disallows you listing any e
-Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows Amazon EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
+Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
@@ -64 +64 @@ Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows Amazon EC2 to a
-Trend Cloud One Decryption Key | Allow | Decrypt | Allow Amazon EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `arn:aws:kms:*:*:alias/ams/eps/cloudone-migration`  
+Trend Cloud One Decryption Key | Allow | Decrypt | Allow EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `aws:kms:*:*:key/*`