AWS cli medium security documentation change

Service: cli · 2025-08-13 · Security-related medium

File: cli/latest/reference/transcribe/start-medical-scribe-job.md

Summary

Updated KMS key specification details, corrected required roles for KMS permissions, added medical-scribe-context parameter with patient pronouns, fixed typos, and updated CLI version references

Security assessment

The correction from requiring both the request role and DataAccessRoleArn to only requiring DataAccessRoleArn for KMS permissions addresses a potential misconfiguration that could lead to overprivileged access. The expanded KMS key specification formats enhance encryption guidance, which is a security feature.

Diff

diff --git a/cli/latest/reference/transcribe/start-medical-scribe-job.md b/cli/latest/reference/transcribe/start-medical-scribe-job.md
index f04188e1b..54e56894f 100644
--- a//cli/latest/reference/transcribe/start-medical-scribe-job.md
+++ b//cli/latest/reference/transcribe/start-medical-scribe-job.md
@@ -15 +15 @@
-  * [AWS CLI 2.28.6 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.8 Command Reference](../../index.html) »
@@ -71 +71 @@ You must include the following parameters in your `StartMedicalTranscriptionJob`
-  * `Settings` : A `MedicalScribeSettings` obect that must set exactly one of `ShowSpeakerLabels` or `ChannelIdentification` to true. If `ShowSpeakerLabels` is true, `MaxSpeakerLabels` must also be set.
+  * `Settings` : A `MedicalScribeSettings` object that must set exactly one of `ShowSpeakerLabels` or `ChannelIdentification` to true. If `ShowSpeakerLabels` is true, `MaxSpeakerLabels` must also be set.
@@ -90,0 +91 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transc
+    [--medical-scribe-context <value>]
@@ -176 +177 @@ JSON Syntax:
-> The Amazon Resource Name (ARN) of a KMS key that you want to use to encrypt your Medical Scribe output.
+> The KMS key you want to use to encrypt your Medical Scribe output.
@@ -178 +179,15 @@ JSON Syntax:
-> KMS key ARNs have the format `arn:partition:kms:region:account:key/key-id` . For example: `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab` . For more information, see [KMS key ARNs](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) .
+> If using a key located in the **current** Amazon Web Services account, you can specify your KMS key in one of four ways:
+> 
+>   * Use the KMS key ID itself. For example, `1234abcd-12ab-34cd-56ef-1234567890ab` .
+>   * Use an alias for the KMS key ID. For example, `alias/ExampleAlias` .
+>   * Use the Amazon Resource Name (ARN) for the KMS key ID. For example, `arn:aws:kms:region:account-ID:key/1234abcd-12ab-34cd-56ef-1234567890ab` .
+>   * Use the ARN for the KMS key alias. For example, `arn:aws:kms:region:account-ID:alias/ExampleAlias` .
+> 
+
+> 
+> If using a key located in a **different** Amazon Web Services account than the current Amazon Web Services account, you can specify your KMS key in one of two ways:
+> 
+>   * Use the ARN for the KMS key ID. For example, `arn:aws:kms:region:account-ID:key/1234abcd-12ab-34cd-56ef-1234567890ab` .
+>   * Use the ARN for the KMS key alias. For example, `arn:aws:kms:region:account-ID:alias/ExampleAlias` .
+> 
+
@@ -182 +197 @@ JSON Syntax:
-> Note that the role making the request and the role specified in the `DataAccessRoleArn` request parameter (if present) must have permission to use the specified KMS key.
+> Note that the role specified in the `DataAccessRoleArn` request parameter must have permission to use the specified KMS key.
@@ -337 +352 @@ JSON Syntax:
-> Adds one or more custom tags, each in the form of a key:value pair, to the Medica Scribe job.
+> Adds one or more custom tags, each in the form of a key:value pair, to the Medical Scribe job.
@@ -376,0 +392,28 @@ JSON Syntax:
+`--medical-scribe-context` (structure)
+
+> The `MedicalScribeContext` object that contains contextual information which is used during clinical note generation to add relevant context to the note.
+> 
+> PatientContext -> (structure)
+>
+>> Contains patient-specific information.
+>> 
+>> Pronouns -> (string)
+>>
+>>> The patient’s preferred pronouns that the user wants to provide as a context for clinical note generation.
+
+Shorthand Syntax:
+    
+    
+    PatientContext={Pronouns=string}
+    
+
+JSON Syntax:
+    
+    
+    {
+      "PatientContext": {
+        "Pronouns": "HE_HIM"|"SHE_HER"|"THEY_THEM"
+      }
+    }
+    
+
@@ -649,0 +693,4 @@ MedicalScribeJob -> (structure)
+> MedicalScribeContextProvided -> (boolean)
+>
+>> Indicates whether the `MedicalScribeContext` object was provided when the Medical Scribe job was started.
+> 
@@ -652 +699 @@ MedicalScribeJob -> (structure)
->> Adds one or more custom tags, each in the form of a key:value pair, to the Medica Scribe job.
+>> Adds one or more custom tags, each in the form of a key:value pair, to the Medical Scribe job.
@@ -684 +731 @@ MedicalScribeJob -> (structure)
-  * [AWS CLI 2.28.6 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.8 Command Reference](../../index.html) »