AWS AmazonS3 documentation change
Summary
Removed multiple JSON policy examples related to KMS encryption configurations for S3 replication
Security assessment
The removed content includes example IAM/KMS policies for replication scenarios, but there is no explicit evidence in the diff that these deletions address a specific security vulnerability. The change appears to be documentation cleanup or restructuring rather than a direct security fix.
Diff
diff --git a/AmazonS3/latest/userguide/replication-config-for-kms-objects.md b/AmazonS3/latest/userguide/replication-config-for-kms-objects.md index 7129d3928..ccf8bcfa9 100644 --- a//AmazonS3/latest/userguide/replication-config-for-kms-objects.md +++ b//AmazonS3/latest/userguide/replication-config-for-kms-objects.md @@ -190,59 +189,0 @@ The following example policy shows statements for using SSE-KMS with separate de -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement":[ - { - "Action": ["kms:Decrypt"], - "Effect": "Allow", - "Condition": { - "StringLike": { - "kms:ViaService": "s3.source-bucket-region.amazonaws.com", - "kms:EncryptionContext:aws:s3:arn": [ - "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" - ] - } - }, - "Resource": [ - "List of AWS KMS key ARNs that are used to encrypt source objects." - ] - }, - { - "Action": ["kms:Encrypt"], - "Effect": "Allow", - "Condition": { - "StringLike": { - "kms:ViaService": "s3.destination-bucket-1-region.amazonaws.com", - "kms:EncryptionContext:aws:s3:arn": [ - "arn:aws:s3:::amzn-s3-demo-destination-bucket1/key-prefix1*" - ] - } - }, - "Resource": [ - "AWS KMS key ARNs (in the same AWS Regionexample-region; as destination bucket 1). Used to encrypt object replicas created in destination bucket 1." - ] - }, - { - "Action": ["kms:Encrypt"], - "Effect": "Allow", - "Condition": { - "StringLike": { - "kms:ViaService": "s3.destination-bucket-2-region.amazonaws.com", - "kms:EncryptionContext:aws:s3:arn": [ - "arn:aws:s3:::amzn-s3-demo-destination-bucket2/key-prefix1*" - ] - } - }, - "Resource": [ - "AWS KMS key ARNs (in the same AWS Regionexample-region; as destination bucket 2). Used to encrypt object replicas created in destination bucket 2." - ] - } - ] - } - - @@ -253,76 +193,0 @@ The following is a complete IAM policy that grants the necessary permissions to -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement":[ - { - "Effect":"Allow", - "Action":[ - "s3:GetReplicationConfiguration", - "s3:ListBucket" - ], - "Resource":[ - "arn:aws:s3:::amzn-s3-demo-source-bucket" - ] - }, - { - "Effect":"Allow", - "Action":[ - "s3:GetObjectVersionForReplication", - "s3:GetObjectVersionAcl" - ], - "Resource":[ - "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" - ] - }, - { - "Effect":"Allow", - "Action":[ - "s3:ReplicateObject", - "s3:ReplicateDelete" - ], - "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/key-prefix1*" - }, - { - "Action":[ - "kms:Decrypt" - ], - "Effect":"Allow", - "Condition":{ - "StringLike":{ - "kms:ViaService":"s3.source-bucket-region.amazonaws.com", - "kms:EncryptionContext:aws:s3:arn":[ - "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" - ] - } - }, - "Resource":[ - "List of the AWS KMS key ARNs that are used to encrypt source objects." - ] - }, - { - "Action":[ - "kms:Encrypt" - ], - "Effect":"Allow", - "Condition":{ - "StringLike":{ - "kms:ViaService":"s3.destination-bucket-region.amazonaws.com", - "kms:EncryptionContext:aws:s3:arn":[ - "arn:aws:s3:::amzn-s3-demo-destination-bucket/prefix1*" - ] - } - }, - "Resource":[ - "AWS KMS key ARNs (in the same aws-region as the destination bucket) to use for encrypting object replicas" - ] - } - ] - } - - @@ -333,76 +197,0 @@ The following is a complete IAM policy that grants the necessary permissions to -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement":[ - { - "Effect":"Allow", - "Action":[ - "s3:GetReplicationConfiguration", - "s3:ListBucket" - ], - "Resource":[ - "arn:aws:s3:::amzn-s3-demo-source-bucket" - ] - }, - { - "Effect":"Allow", - "Action":[ - "s3:GetObjectVersionForReplication", - "s3:GetObjectVersionAcl" - ], - "Resource":[ - "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" - ] - }, - { - "Effect":"Allow", - "Action":[ - "s3:ReplicateObject", - "s3:ReplicateDelete" - ], - "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/key-prefix1*" - }, - { - "Action":[ - "kms:Decrypt" - ], - "Effect":"Allow", - "Condition":{ - "StringLike":{ - "kms:ViaService":"s3.source-bucket-region.amazonaws.com", - "kms:EncryptionContext:aws:s3:arn":[ - "arn:aws:s3:::amzn-s3-demo-source-bucket" - ] - } - }, - "Resource":[ - "List of the AWS KMS key ARNs that are used to encrypt source objects." - ] - }, - { - "Action":[ - "kms:Encrypt"