AWS connect medium security documentation change

Service: connect · 2025-08-16 · Security-related medium

File: connect/latest/adminguide/encryption-at-rest.md

Summary

Updated KMS policy example with consolidated conditions and explicit region

Security assessment

Improved KMS policy conditions enhance security by restricting service access to specific regions and context. The change adds explicit kms:ViaService region restriction and simplifies policy structure for better security posture.

Diff

diff --git a/connect/latest/adminguide/encryption-at-rest.md b/connect/latest/adminguide/encryption-at-rest.md
index 0c06e4f96..5c1f195c0 100644
--- a//connect/latest/adminguide/encryption-at-rest.md
+++ b//connect/latest/adminguide/encryption-at-rest.md
@@ -508,39 +508,33 @@ JSON
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "Allow key access to Amazon Connect outbound campaigns.",
-          "Effect": "Allow",
-          "Principal": {
-            "AWS": "your_user_or_role_ARN"
-          },
-          "Action": [
-            "kms:Decrypt",
-            "kms:CreateGrant"
-          ],
-          "Resource": "*",
-          "Condition": {
-            "StringEquals": {
-              "kms:ViaService": [
-                "connect-campaigns.<region>.amazonaws.com"
-              ]
-            },
-            "StringEquals": {
-                "kms:EncryptionContext:aws:accountId": "111122223333",
-                "kms:EncryptionContext:aws:connect:instanceId": "sample instance id"
-            }
-          }
-        },
-        {
-            "Sid": "Allow direct access to key metadata to the account",
-            "Effect": "Allow",
-            "Principal": {
-                "AWS": [
-                "arn:aws:iam::111122223333:root"
-                ]
-            },
-            "Action": [
-                "kms:Describe*"
-            ],
-            "Resource": "*"
-         }
-      ]
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Sid": "Allow key access to Amazon Connect outbound campaigns.",
+          "Effect": "Allow",
+          "Principal": {
+            "AWS": "your_user_or_role_ARN"
+          },
+          "Action": [
+            "kms:Decrypt",
+            "kms:CreateGrant"
+          ],
+          "Resource": "*",
+          "Condition": {
+            "StringEquals": {
+              "kms:ViaService": "connect-campaigns.us-east-1.amazonaws.com",
+              "kms:EncryptionContext:aws:accountId": "111122223333",
+              "kms:EncryptionContext:aws:connect:instanceId": "InstanceID"
+            }
+          }
+        },
+        {
+          "Sid": "Allow direct access to key metadata to the account",
+          "Effect": "Allow",
+          "Principal": {
+             "AWS": "arn:aws:iam::111122223333:root"
+          },
+          "Action": [
+            "kms:Describe*"
+          ],
+          "Resource": "*"
+        }
+      ]