AWS aws-backup high security documentation change

Service: aws-backup · 2025-10-01 · Security-related high

File: aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md

Summary

Removed an example KMS policy demonstrating cross-service confused deputy prevention for AWS Backup Storage service principal

Security assessment

The removed policy explicitly demonstrated security controls (Deny policy with source ARN/account conditions) to prevent cross-service confused deputy attacks. Removing this example reduces clarity on implementing critical security protections for KMS keys used by Backup.

Diff

diff --git a/aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md b/aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md
index 3174d4aa0..3a6ff6a27 100644
--- a//aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md
+++ b//aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md
@@ -17,35 +16,0 @@ The following example policy shows how you can use the `aws:SourceArn` and `aws:
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "Allow root all KMS access",
-          "Effect": "Allow",
-          "Principal": {
-            "AWS": "arn:aws:iam::123456789012:root"
-          },
-          "Action": "kms:*",
-          "Resource": "*"
-        },
-        {
-          "Sid": "Allow Backup Storage SPN backup related operations on Key",
-          "Effect": "Deny",
-          "Principal": {
-            "Service": "backup-storage.amazonaws.com"
-          },
-          "Action": [
-            "kms:Decrypt",
-            "kms:RetireGrant",
-            "kms:GenerateDataKey"
-          ],
-          "Resource": "*",
-          "Condition": {
-            "ForAllValues:StringNotLike": {
-              "aws:SourceArn": ["arn:aws:backup:us-east-1:123456789012:backup-vault:*"], 
-              "aws:SourceAccount": ["123456789012"]
-            }
-          }
-        }
-      ]
-    }
-