AWS cli medium security documentation change
Summary
Updated KMS key documentation with standardized ARN format and modified permission requirements to include both requesting role and DataAccessRoleArn.
Security assessment
The changes enhance encryption configuration guidance and expand required permissions for KMS key usage. This addresses potential authorization gaps where only one role might have permissions, reducing risk of encryption failures or unauthorized decryption. The standardized ARN format helps prevent key misconfiguration errors.
Diff
diff --git a/cli/latest/reference/transcribe/start-medical-scribe-job.md b/cli/latest/reference/transcribe/start-medical-scribe-job.md index 5a3f882f8..84bed42d3 100644 --- a//cli/latest/reference/transcribe/start-medical-scribe-job.md +++ b//cli/latest/reference/transcribe/start-medical-scribe-job.md @@ -15 +15 @@ - * [AWS CLI 2.31.13 Command Reference](../../index.html) » + * [AWS CLI 2.31.16 Command Reference](../../index.html) » @@ -208 +208 @@ JSON Syntax: -> The KMS key you want to use to encrypt your Medical Scribe output. +> The Amazon Resource Name (ARN) of a KMS key that you want to use to encrypt your Medical Scribe output. @@ -210,15 +210 @@ JSON Syntax: -> If using a key located in the **current** Amazon Web Services account, you can specify your KMS key in one of four ways: -> -> * Use the KMS key ID itself. For example, `1234abcd-12ab-34cd-56ef-1234567890ab` . -> * Use an alias for the KMS key ID. For example, `alias/ExampleAlias` . -> * Use the Amazon Resource Name (ARN) for the KMS key ID. For example, `arn:aws:kms:region:account-ID:key/1234abcd-12ab-34cd-56ef-1234567890ab` . -> * Use the ARN for the KMS key alias. For example, `arn:aws:kms:region:account-ID:alias/ExampleAlias` . -> - -> -> If using a key located in a **different** Amazon Web Services account than the current Amazon Web Services account, you can specify your KMS key in one of two ways: -> -> * Use the ARN for the KMS key ID. For example, `arn:aws:kms:region:account-ID:key/1234abcd-12ab-34cd-56ef-1234567890ab` . -> * Use the ARN for the KMS key alias. For example, `arn:aws:kms:region:account-ID:alias/ExampleAlias` . -> - +> KMS key ARNs have the format `arn:partition:kms:region:account:key/key-id` . For example: `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab` . For more information, see [KMS key ARNs](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) . @@ -228 +214 @@ JSON Syntax: -> Note that the role specified in the `DataAccessRoleArn` request parameter must have permission to use the specified KMS key. +> Note that the role making the request and the role specified in the `DataAccessRoleArn` request parameter (if present) must have permission to use the specified KMS key. @@ -1042 +1028 @@ MedicalScribeJob -> (structure) - * [AWS CLI 2.31.13 Command Reference](../../index.html) » + * [AWS CLI 2.31.16 Command Reference](../../index.html) »