AWS AmazonElastiCache medium security documentation change

Service: AmazonElastiCache · 2025-07-18 · Security-related medium

File: AmazonElastiCache/latest/dg/IAM.ConditionKeys.md

Summary

Added guidance for using AWS Global Condition Keys with ElastiCache principals and multiple JSON formatting markers

Security assessment

Explicitly warns that policies must include both elasticache.amazonaws.com and ec.amazonaws.com principals to enforce security controls properly. Missing this could lead to misconfigured policies allowing unintended access.

Diff

diff --git a/AmazonElastiCache/latest/dg/IAM.ConditionKeys.md b/AmazonElastiCache/latest/dg/IAM.ConditionKeys.md
index e9f1cb8f0..dd38b8c6b 100644
--- a//AmazonElastiCache/latest/dg/IAM.ConditionKeys.md
+++ b//AmazonElastiCache/latest/dg/IAM.ConditionKeys.md
@@ -14,0 +15,30 @@ For a list of global condition keys, see [AWS global condition context keys](htt
+**Using ElastiCache With AWS Global Condition Keys**
+
+When using [AWS Global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) that require ElastiCache's [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services), use an `OR` condition with _both_ Principals: `elasticache.amazonaws.com` and `ec.amazonaws.com`.
+
+###### Note
+
+If you do not add both Principals for ElastiCache, the intended “Allow” or “Deny” action will not be enforced correctly for any resource listed in your policy.
+
+Example of policy with `aws:CalledVia` global condition key:
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": "ec2:*", 
+          "Resource": "*",
+          "Condition": {
+            "ForAnyValue:StringLike": {
+              "aws:CalledVia": [
+                "ec.amazonaws.com",
+                "elasticache.amazonaws.com"
+              ]
+            }
+          }
+        }
+      ]
+    }
+
@@ -31,0 +62,6 @@ The following shows an example of this permissions policy when using Valkey or R
+JSON
+    
+
+****
+    
+    
@@ -69,0 +107,6 @@ The following shows an example of this permissions policy when using Memcached.
+JSON
+    
+
+****
+    
+    
@@ -112,0 +157,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -149,0 +201,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -183,0 +242,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -222,0 +288,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -258,0 +331,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -291,0 +371,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -327,0 +414,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -363,0 +457,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -396,0 +497,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -432,0 +540,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+    
@@ -468,0 +583,6 @@ This section shows example policies for implementing fine-grained access control
+JSON
+    
+
+****
+    
+        
@@ -503,0 +625,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `false`
+JSON
+    
+
+****
+    
+        
@@ -538,0 +667,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+        
@@ -562,0 +698,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -595,0 +738,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -630,0 +780,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -663,0 +820,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -700,0 +864,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -739,0 +910,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -773,0 +951,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -810,0 +995,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+
+****
+    
+    
@@ -844,0 +1036,6 @@ When the `elasticache:TransitEncryptionEnabled` condition key is set to `true` i
+JSON
+    
+