AWS AmazonS3 documentation change
Summary
Added detailed IAM policies for KMS-encrypted object replication with resource constraints
Security assessment
The changes provide secure replication configuration examples with KMS key usage and encryption context conditions. This improves documentation of security best practices but does not indicate a vulnerability fix.
Diff
diff --git a/AmazonS3/latest/userguide/replication-config-for-kms-objects.md b/AmazonS3/latest/userguide/replication-config-for-kms-objects.md index 6fcb77c0a..577712340 100644 --- a//AmazonS3/latest/userguide/replication-config-for-kms-objects.md +++ b//AmazonS3/latest/userguide/replication-config-for-kms-objects.md @@ -193,0 +194,76 @@ The following is a complete IAM policy that grants the necessary permissions to +JSON + + +**** + + + + { + "Version":"2012-10-17", + "Statement":[ + { + "Effect":"Allow", + "Action":[ + "s3:GetReplicationConfiguration", + "s3:ListBucket" + ], + "Resource":[ + "arn:aws:s3:::amzn-s3-demo-source-bucket" + ] + }, + { + "Effect":"Allow", + "Action":[ + "s3:GetObjectVersionForReplication", + "s3:GetObjectVersionAcl" + ], + "Resource":[ + "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" + ] + }, + { + "Effect":"Allow", + "Action":[ + "s3:ReplicateObject", + "s3:ReplicateDelete" + ], + "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/key-prefix1*" + }, + { + "Action":[ + "kms:Decrypt" + ], + "Effect":"Allow", + "Condition":{ + "StringLike":{ + "kms:ViaService":"s3.us-east-1.amazonaws.com", + "kms:EncryptionContext:aws:s3:arn":[ + "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" + ] + } + }, + "Resource":[ + "arn:aws:kms:us-east-1:111122223333:key/key-id" + ] + }, + { + "Action":[ + "kms:Encrypt" + ], + "Effect":"Allow", + "Condition":{ + "StringLike":{ + "kms:ViaService":"s3.us-east-1.amazonaws.com", + "kms:EncryptionContext:aws:s3:arn":[ + "arn:aws:s3:::amzn-s3-demo-destination-bucket/prefix1*" + ] + } + }, + "Resource":[ + "arn:aws:kms:us-east-1:111122223333:key/key-id" + ] + } + ] + } + + @@ -197,0 +274,76 @@ The following is a complete IAM policy that grants the necessary permissions to +JSON + + +**** + + + + { + "Version":"2012-10-17", + "Statement":[ + { + "Effect":"Allow", + "Action":[ + "s3:GetReplicationConfiguration", + "s3:ListBucket" + ], + "Resource":[ + "arn:aws:s3:::amzn-s3-demo-source-bucket" + ] + }, + { + "Effect":"Allow", + "Action":[ + "s3:GetObjectVersionForReplication", + "s3:GetObjectVersionAcl" + ], + "Resource":[ + "arn:aws:s3:::amzn-s3-demo-source-bucket/key-prefix1*" + ] + }, + { + "Effect":"Allow", + "Action":[ + "s3:ReplicateObject", + "s3:ReplicateDelete" + ], + "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/key-prefix1*" + }, + { + "Action":[ + "kms:Decrypt" + ], + "Effect":"Allow", + "Condition":{ + "StringLike":{ + "kms:ViaService":"s3.us-east-1.amazonaws.com", + "kms:EncryptionContext:aws:s3:arn":[ + "arn:aws:s3:::amzn-s3-demo-source-bucket" + ] + } + }, + "Resource":[ + "arn:aws:kms:us-east-1:111122223333:key/key-id" + ] + }, + { + "Action":[ + "kms:Encrypt" + ], + "Effect":"Allow", + "Condition":{ + "StringLike":{ + "kms:ViaService":"s3.us-east-1.amazonaws.com", + "kms:EncryptionContext:aws:s3:arn":[ + "arn:aws:s3:::amzn-s3-demo-destination-bucket" + ] + } + }, + "Resource":[ + "arn:aws:kms:us-east-1:111122223333:key/key-id" + ] + } + ] + } + +