AWS kms documentation change

Service: kms · 2025-07-25 · Documentation low

File: kms/latest/developerguide/vpce-policy-condition.md

Summary

Reformatted JSON policies with improved syntax, updated SID values to PascalCase, and expanded action lists

Security assessment

Changes improve policy readability but do not alter security semantics or address vulnerabilities. Example policy content remains functionally equivalent.

Diff

diff --git a/kms/latest/developerguide/vpce-policy-condition.md b/kms/latest/developerguide/vpce-policy-condition.md
index ea0079ff3..085c2a4c3 100644
--- a//kms/latest/developerguide/vpce-policy-condition.md
+++ b//kms/latest/developerguide/vpce-policy-condition.md
@@ -27,0 +28,6 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
+JSON
+    
+
+****
+    
+    
@@ -66,0 +74,6 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
+JSON
+    
+
+****
+    
+    
@@ -73 +86 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Sid": "Allow administrative actions from vpc-12345678",
+                "Sid": "AllowAdministrativeActionsFromVPC",
@@ -75 +88,3 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Principal": {"AWS": "111122223333"},
+                "Principal": {
+                    "AWS": "111122223333"
+                },
@@ -77,3 +92,9 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                    "kms:Create*","kms:Enable*","kms:Put*","kms:Update*",
-                    "kms:Revoke*","kms:Disable*","kms:Delete*",
-                    "kms:TagResource", "kms:UntagResource"
+                    "kms:Create*",
+                    "kms:Enable*",
+                    "kms:Put*",
+                    "kms:Update*",
+                    "kms:Revoke*",
+                    "kms:Disable*",
+                    "kms:Delete*",
+                    "kms:TagResource",
+                    "kms:UntagResource"
@@ -89 +110 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Sid": "Allow key usage from vpc-2b2b2b2b",
+                "Sid": "AllowKeyUsageFromVPC2b2b2b2b",
@@ -91 +112,3 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Principal": {"AWS": "111122223333"},
+                "Principal": {
+                    "AWS": "111122223333"
+                },
@@ -93 +116,3 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                    "kms:Encrypt","kms:Decrypt","kms:GenerateDataKey*"
+                    "kms:Encrypt",
+                    "kms:Decrypt",
+                    "kms:GenerateDataKey*"
@@ -103 +128 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Sid": "Allow read actions from everywhere",
+                "Sid": "AllowReadActionsEverywhere",
@@ -105 +130,3 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Principal": {"AWS": "111122223333"},
+                "Principal": {
+                    "AWS": "111122223333"
+                },
@@ -107 +134,3 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                    "kms:Describe*","kms:List*","kms:Get*"
+                    "kms:Describe*",
+                    "kms:List*",
+                    "kms:Get*"
@@ -109 +138 @@ To use a policy like this one, replace the placeholder AWS account ID and VPC en
-                "Resource": "*",
+                "Resource": "*"