AWS Security ChangesHomeSearch

AWS keyspaces documentation change

Service: keyspaces · 2025-07-04 · Documentation low

File: keyspaces/latest/devguide/security-iam-awsmanpol.md

Summary

Added documentation for new AWS managed policy KeyspacesCDCServiceRolePolicy and updated existing policies (AmazonKeyspacesReadOnlyAccess_v2, AmazonKeyspacesReadOnlyAccess, AmazonKeyspacesFullAccess) to include CDC stream viewing permissions and service-linked role details

Security assessment

The changes document IAM policy updates for CDC stream monitoring and service-linked roles, which are security-related features. However, there's no evidence of addressing a specific security vulnerability or incident.

Diff

diff --git a/keyspaces/latest/devguide/security-iam-awsmanpol.md b/keyspaces/latest/devguide/security-iam-awsmanpol.md
index 6e2830186..20bcfb8df 100644
--- a//keyspaces/latest/devguide/security-iam-awsmanpol.md
+++ b//keyspaces/latest/devguide/security-iam-awsmanpol.md
@@ -5 +5 @@
-AmazonKeyspacesReadOnlyAccess_v2AmazonKeyspacesReadOnlyAccessAmazonKeyspacesFullAccessPolicy updates
+AmazonKeyspacesReadOnlyAccess_v2AmazonKeyspacesReadOnlyAccessAmazonKeyspacesFullAccessKeyspacesCDCServiceRolePolicyPolicy updates
@@ -28,0 +29,2 @@ This policy includes the following permissions.
+  * `Amazon Keyspaces CDC streams` – Allows principals to view Amazon Keyspaces CDC streams.
+
@@ -53,0 +56,2 @@ This policy includes the following permissions.
+  * `Amazon Keyspaces CDC streams` – Allows principals to view Amazon Keyspaces CDC streams.
+
@@ -82,0 +87,2 @@ This policy includes the following permissions.
+    * `Amazon Keyspaces CDC streams` – When an administrator enables a stream for a table, Amazon Keyspaces creates the service-linked role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams) to publish CloudWatch metrics into your account on your behalf.
+
@@ -95,0 +102,17 @@ To review the policy in `JSON` format, see [AmazonKeyspacesFullAccess](https://d
+## AWS managed policy: KeyspacesCDCServiceRolePolicy
+
+You can't attach `KeyspacesCDCServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon Keyspaces to perform actions on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](./using-service-linked-roles-CDC-streams.html).
+
+This policy grants the required permissions to the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish Amazon Keyspaces CDC stream metrics data to CloudWatch on your behalf.
+
+**Permissions details**
+
+This policy includes the following permissions.
+
+  * `CloudWatch` – Allows the service-linked-role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams) to publish metric data from Amazon Keyspaces CDC streams into the `"cloudwatch:namespace": "AWS/Cassandra"` in your CloudWatch account on your behalf.
+
+
+
+
+To review the policy in `JSON` format, see [KeyspacesCDCServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/KeyspacesCDCServiceRolePolicy.html).
+
@@ -101,0 +125,4 @@ Change | Description | Date
+KeyspacesCDCServiceRolePolicy – New policy |  Amazon Keyspaces added a new managed policy `KeyspacesCDCServiceRolePolicy` which grants the required permissions to the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish Amazon Keyspaces CDC stream metrics data to CloudWatch on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](./using-service-linked-roles-CDC-streams.html). | July 02, 2025  
+AmazonKeyspacesReadOnlyAccess_v2 – Update to an existing policy |  Amazon Keyspaces added new permissions to allow IAM principals to view Amazon Keyspaces CDC streams. For more information, see [View CDC streams in Amazon Keyspaces](./keyspaces-view-cdc.html). | July 02, 2025  
+AmazonKeyspacesReadOnlyAccess – Update to an existing policy |  Amazon Keyspaces added new permissions to allow IAM principals to view Amazon Keyspaces CDC streams. For more information, see [View CDC streams in Amazon Keyspaces](./keyspaces-view-cdc.html). | July 02, 2025  
+AmazonKeyspacesFullAccess – Update to an existing policy |  Amazon Keyspaces created the `KeyspacesCDCServiceRolePolicy` managed policy for the service linked role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams) to add the permissions that are required when an administrator enables a stream for a table. Amazon Keyspaces uses the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish CloudWatch metrics into your account on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](./using-service-linked-roles-CDC-streams.html). | July 02, 2025  
@@ -106,2 +133,2 @@ AmazonKeyspacesFullAccess – Update to an existing policy |  Amazon Keyspaces a
-AmazonKeyspacesReadOnlyAccess – Update to an existing policy |  Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics and dimensions](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022  
-AmazonKeyspacesFullAccess – Update to an existing policy |  Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics and dimensions](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022  
+AmazonKeyspacesReadOnlyAccess – Update to an existing policy |  Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022  
+AmazonKeyspacesFullAccess – Update to an existing policy |  Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022