AWS payment-cryptography documentation change
Summary
Updated AWS CLI version reference, corrected service name from 'AWS Pricing Calculator' to 'AWS Payment Cryptography', and removed account IDs from example ARNs
Security assessment
Changes involve documentation corrections and example sanitization (removing account IDs from ARNs). No evidence of addressing a security vulnerability. Sanitizing examples is a best practice but not a direct security fix.
Diff
diff --git a/payment-cryptography/latest/userguide/keys-export.md b/payment-cryptography/latest/userguide/keys-export.md index d49a85b91..a6def134f 100644 --- a//payment-cryptography/latest/userguide/keys-export.md +++ b//payment-cryptography/latest/userguide/keys-export.md @@ -34 +34 @@ Export symmetric keysExport DUKPT Initial Keys (IPEK/IK)Export asymmetric (RSA) -Make sure you have the latest version of AWS CLI V2 before you begin. To upgrade, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). +Make sure you have the latest version of AWS CLI before you begin. To upgrade, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). @@ -95 +95 @@ Call the **ExportKey** API with `KeyMaterialType` set to `TR34_KEY_BLOCK`. You n - "CertificateAuthorityPublicKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/4kd6xud22e64wcbk", \ + "CertificateAuthorityPublicKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/4kd6xud22e64wcbk", \ @@ -117 +117 @@ Elliptic Curve Diffie-Hellman (ECDH) uses ECC asymmetric cryptography to establi -When exporting, AWS Pricing Calculator is referred to as Party U (Initiator) and the receiving system is known as Party V (Responder). +When exporting, AWS Payment Cryptography is referred to as Party U (Initiator) and the receiving system is known as Party V (Responder). @@ -135 +135 @@ Although low-level ECDH generates a derived key that can be used for any purpose - "KeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/wc3rjsssguhxtilv", + "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/wc3rjsssguhxtilv", @@ -168 +168 @@ Call `get-public-key-certificate` to receive the public key as an X.509 certific - --key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/wc3rjsssguhxtilv + --key-identifier arn:aws:payment-cryptography:us-east-2::key/wc3rjsssguhxtilv @@ -202 +202 @@ When exporting, the service derives a key using ECDH and then immediately uses i - "CertificateAuthorityPublicKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/swseahwtq2oj6zi5", + "CertificateAuthorityPublicKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/swseahwtq2oj6zi5", @@ -209 +209 @@ When exporting, the service derives a key using ECDH and then immediately uses i - "PrivateKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/wc3rjsssguhxtilv", + "PrivateKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/wc3rjsssguhxtilv", @@ -275 +275 @@ Use **import-key** with the `--key-material` option to import the certificate - "KeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/nsq2i3mbg6sn775f", + "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/nsq2i3mbg6sn775f", @@ -315 +315 @@ The output is a hex-encoded binary wrapped (encrypted) version of your symmetric - "ExportKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/tqv5yij6wtxx64pi", + "ExportKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/tqv5yij6wtxx64pi", @@ -318 +318 @@ The output is a hex-encoded binary wrapped (encrypted) version of your symmetric - "CertificateAuthorityPublicKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/zabouwe3574jysdl", + "CertificateAuthorityPublicKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/zabouwe3574jysdl", @@ -372,2 +372,2 @@ When exporting in TR-31 format, specify the key you want to export and the wrapp - { "WrappingKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/ov6icy4ryas4zcza" }}' \ - --export-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/5rplquuwozodpwsp + { "WrappingKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/ov6icy4ryas4zcza" }}' \ + --export-key-identifier arn:aws:payment-cryptography:us-east-2::key/5rplquuwozodpwsp @@ -427,2 +427,2 @@ The counter portion of the KSN (32 bits for AES DUKPT) isn't used for IPEK/IK de - "WrappingKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/ov6icy4ryas4zcza"}} ' \ - --export-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/tqv5yij6wtxx64pi \ + "WrappingKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/ov6icy4ryas4zcza"}} ' \ + --export-key-identifier arn:aws:payment-cryptography:us-east-2::key/tqv5yij6wtxx64pi \ @@ -517 +517 @@ Here's an example of exporting a BDK key (for instance, to a KIF) with these spe -Because we don't specify key modes of use, this key inherits the mode of use from arn:aws:payment-cryptography:us-east-2:111122223333:key/5rplquuwozodpwsp (DeriveKey = true). +Because we don't specify key modes of use, this key inherits the mode of use from arn:aws:payment-cryptography:us-east-2::key/5rplquuwozodpwsp (DeriveKey = true). @@ -535 +535 @@ This is specifically allowed by the standards. - "WrappingKeyIdentifier": "arn:aws:payment-cryptography:us-east-2:111122223333:key/ov6icy4ryas4zcza", \ + "WrappingKeyIdentifier": "arn:aws:payment-cryptography:us-east-2::key/ov6icy4ryas4zcza", \ @@ -544 +544 @@ This is specifically allowed by the standards. - --export-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/5rplquuwozodpwsp + --export-key-identifier arn:aws:payment-cryptography:us-east-2::key/5rplquuwozodpwsp @@ -575 +575 @@ This operation is not idempotent—subsequent calls might generate different cer - --key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/5dza7xqd6soanjtb + --key-identifier arn:aws:payment-cryptography:us-east-2::key/5dza7xqd6soanjtb