AWS kms medium security documentation change
Summary
Added guidance on IPv6 address handling in IAM/KMS policies and updated terminology consistency
Security assessment
Explicitly warns about the risk of misconfigured IP-based policies when using IPv6, which could lead to unintended access. The documentation update addresses a potential security gap where legacy IPv4-only policies might improperly allow/deny access in dual-stack environments.
Diff
diff --git a/kms/latest/developerguide/conditions-aws.md b/kms/latest/developerguide/conditions-aws.md index 472495322..8df7a9bd1 100644 --- a//kms/latest/developerguide/conditions-aws.md +++ b//kms/latest/developerguide/conditions-aws.md @@ -25 +25 @@ The following topics provide special guidance for using condition keys based on - * Using IPv6 addresses in IAM and KMS key policies + * Using IPv6 addresses in IAM and AWS KMS key policies @@ -62 +62 @@ Take care to avoid a situation like the IP address condition keys example. If yo -## Using IPv6 addresses in IAM and KMS key policies +## Using IPv6 addresses in IAM and AWS KMS key policies @@ -64 +64 @@ Take care to avoid a situation like the IP address condition keys example. If yo -Before trying to access KMS over IPv6, ensure any key and IAM policies containing IP address restrictions are updated to include IPv6 address ranges. IP based policies that are not updated to handle IPv6 addresses may result in clients incorrectly losing or gaining access when they start using IPv6. For general guidance on KMS access controls, see [KMS key access and permissions](./control-access.html). To learn about KMS and dual stack support, see [Dual-stack endpoint support](./ipv6-kms.html). +Before trying to access AWS KMS over IPv6, ensure any key and IAM policies containing IP address restrictions are updated to include IPv6 address ranges. IP based policies that are not updated to handle IPv6 addresses may result in clients incorrectly losing or gaining access when they start using IPv6. For general guidance on KMS access controls, see [KMS key access and permissions](./control-access.html). To learn about KMS and dual stack support, see [Dual-stack endpoint support](./ipv6-kms.html).