AWS macie documentation change
Summary
Updated documentation to specify 'us-east-1' region in ARN examples, clarify region references, and improve code formatting
Security assessment
Changes primarily involve updating region placeholders to concrete examples (us-east-1) and formatting improvements (backticks around * wildcard). While KMS key configuration is security-related, these changes represent documentation clarifications rather than addressing specific vulnerabilities. No evidence of patching security flaws or disclosing new security features.
Diff
diff --git a/macie/latest/user/discovery-results-repository-s3.md b/macie/latest/user/discovery-results-repository-s3.md index 4accae4a3..58f73dbcb 100644 --- a//macie/latest/user/discovery-results-repository-s3.md +++ b//macie/latest/user/discovery-results-repository-s3.md @@ -181,2 +181,2 @@ After you determine which KMS key you want Macie to use, give Macie permission t - "arn:aws:macie2:Region:111122223333:export-configuration:*", - "arn:aws:macie2:Region:111122223333:classification-job/*" + "arn:aws:macie2:us-east-1:111122223333:export-configuration:*", + "arn:aws:macie2:us-east-1:111122223333:classification-job/*" @@ -198 +198 @@ When you add the statement to the policy, make sure that the syntax is valid. Po - * `Region` is the AWS Region in which you're using Macie and you want to allow Macie to use the key. + * `us-east-1` is the Region code for the AWS Region in which you're using Macie and want to allow Macie to use the key. @@ -209 +209 @@ If you use Macie in multiple Regions and want to allow Macie to use the key in a -Alternatively, you can allow Macie to use the key in all Regions. To do this, replace the placeholder value with the wildcard character (*). For example: +Alternatively, you can allow Macie to use the key in all Regions. To do this, replace the placeholder value with the wildcard character (`*`). For example: @@ -216 +216,3 @@ Alternatively, you can allow Macie to use the key in all Regions. To do this, re - * If you're using Macie in an opt-in Region, add the appropriate Region code to the value for the `Service` field. For example, if you're using Macie in the Middle East (Bahrain) Region, which has the Region code _me-south-1_ , replace `macie.amazonaws.com` with `macie.me-south-1.amazonaws.com`. For a list of Regions where Macie is currently available and the Region code for each one, see [Amazon Macie endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/macie.html) in the _AWS General Reference_. + * If you're using Macie in an opt-in Region, add the appropriate Region code to the value for the `Service` field. For example, if you're using Macie in the Middle East (Bahrain) Region, which has the Region code _me-south-1_ , replace `macie.amazonaws.com` with `macie.me-south-1.amazonaws.com`. + +For a list of Regions where Macie is currently available and the Region code for each one, see [Amazon Macie endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/macie.html) in the _AWS General Reference_. @@ -287 +289 @@ For information about these settings, see [Blocking public access to your Amazon - * To use a key that another account owns, choose **Enter the ARN of a key from another account**. Then, in the **AWS KMS key ARN** box, enter the Amazon Resource Name (ARN) of the key to use—for example, `arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`. + * To use a key that another account owns, choose **Enter the ARN of a key from another account**. Then, in the **AWS KMS key ARN** box, enter the Amazon Resource Name (ARN) of the key to use—for example, ``arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab``. @@ -398 +400 @@ JSON - "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:Region:111122223333:key/KMSKeyId" + "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:111122223333:key/KMSKeyId" @@ -426 +428 @@ JSON - * In the `StringNotEquals` condition, replace `arn:aws:kms:Region:111122223333:key/KMSKeyId` with the Amazon Resource Name (ARN) of the AWS KMS key to use for encryption of your discovery results. + * In the `StringNotEquals` condition, replace `arn:aws:kms:us-east-1:111122223333:key/KMSKeyId` with the Amazon Resource Name (ARN) of the AWS KMS key to use for encryption of your discovery results. @@ -436 +438 @@ JSON - * `Region` is the AWS Region in which you're using Macie and want to allow Macie to add discovery results to the bucket. + * `us-east-1` is the Region code for the AWS Region in which you're using Macie and want to allow Macie to add discovery results to the bucket. @@ -447 +449 @@ If you use Macie in multiple Regions and want to allow Macie to add results to t -Alternatively, you can allow Macie to add results to the bucket for all Regions in which you use Macie. To do this, replace the placeholder value with the wildcard character (*). For example: +Alternatively, you can allow Macie to add results to the bucket for all Regions in which you use Macie. To do this, replace the placeholder value with the wildcard character (`*`). For example: @@ -454 +456,3 @@ Alternatively, you can allow Macie to add results to the bucket for all Regions - * If you're using Macie in an opt-in Region, add the appropriate Region code to the value for the `Service` field in each statement that specifies the Macie service principal. For example, if you're using Macie in the Middle East (Bahrain) Region, which has the Region code _me-south-1_ , replace `macie.amazonaws.com` with `macie.me-south-1.amazonaws.com` in each applicable statement. For a list of Regions where Macie is currently available and the Region code for each one, see [Amazon Macie endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/macie.html) in the _AWS General Reference_. + * If you're using Macie in an opt-in Region, add the appropriate Region code to the value for the `Service` field in each statement that specifies the Macie service principal. For example, if you're using Macie in the Middle East (Bahrain) Region, which has the Region code _me-south-1_ , replace `macie.amazonaws.com` with `macie.me-south-1.amazonaws.com` in each applicable statement. + +For a list of Regions where Macie is currently available and the Region code for each one, see [Amazon Macie endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/macie.html) in the _AWS General Reference_.