AWS keyspaces documentation change
Summary
Added documentation about automatic encryption of CDC streams using the same key as underlying tables
Security assessment
Expands security documentation by clarifying encryption coverage for CDC streams, but does not indicate resolution of a security vulnerability
Diff
diff --git a/keyspaces/latest/devguide/EncryptionAtRest.md b/keyspaces/latest/devguide/EncryptionAtRest.md index 545c553f0..4c7502ce1 100644 --- a//keyspaces/latest/devguide/EncryptionAtRest.md +++ b//keyspaces/latest/devguide/EncryptionAtRest.md @@ -11 +11 @@ Amazon Keyspaces encryption at rest encrypts your data using 256-bit Advanced En -Amazon Keyspaces encrypts and decrypts the table data transparently. Amazon Keyspaces uses envelope encryption and a key hierarchy to protect data encryption keys. It integrates with AWS KMS for storing and managing the root encryption key. For more information about the encryption key hierarchy, see [Encryption at rest: How it works in Amazon Keyspaces](./encryption.howitworks.html). For more information about AWS KMS concepts like envelope encryption, see [AWS KMS management service concepts](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) in the _AWS Key Management Service Developer Guide_. +Amazon Keyspaces encrypts and decrypts the data in tables and streams transparently. Amazon Keyspaces uses envelope encryption and a key hierarchy to protect data encryption keys. It integrates with AWS KMS for storing and managing the root encryption key. For more information about the encryption key hierarchy, see [Encryption at rest: How it works in Amazon Keyspaces](./encryption.howitworks.html). For more information about AWS KMS concepts like envelope encryption, see [AWS KMS management service concepts](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) in the _AWS Key Management Service Developer Guide_. @@ -21,0 +22,2 @@ When creating a new table, you can choose one of the following _AWS KMS keys (KM +Amazon Keyspaces automatically encrypts change data capture (CDC) streams with the same key as the underlying table. For more information about CDC, see [Working with change data capture (CDC) streams in Amazon Keyspaces](./cdc.html). +