AWS comprehend high security documentation change

Service: comprehend · 2025-10-25 · Security-related high

File: comprehend/latest/dg/custom-copy-sharing.md

Summary

Revised KMS key policy example to enforce 'aws:SourceArn' conditions, restricting usage to Amazon Comprehend requests.

Security assessment

The updated policy example explicitly restricts KMS key usage to requests originating from Amazon Comprehend, mitigating the risk of confused deputy attacks. This is a direct security improvement to prevent privilege escalation via misconfigured policies.

Diff

diff --git a/comprehend/latest/dg/custom-copy-sharing.md b/comprehend/latest/dg/custom-copy-sharing.md
index b9f97fe1a..63e4e98fa 100644
--- a//comprehend/latest/dg/custom-copy-sharing.md
+++ b//comprehend/latest/dg/custom-copy-sharing.md
@@ -75,0 +76,6 @@ In the following example, the policy authorizes AWS account `444455556666` to us
+JSON
+    
+
+****
+    
+    
@@ -118,0 +126 @@ The following example policy authorizes user **ExampleUser** from AWS account `4
+The following example policy authorizes AWS account `444455556666` to access this KMS key via the Amazon Comprehend service, using an alternative syntax to the previous example. 
@@ -120,19 +128 @@ The following example policy authorizes user **ExampleUser** from AWS account `4
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {
-                "AWS": [
-                    "arn:aws:iam::444455556666:user/ExampleUser",
-                    "arn:aws:iam::123456789012:role/ExampleRole"
-                  ]
-            },
-            "Action": [
-                "kms:Decrypt",
-                "kms:GenerateDataKey"
-            ],
-            "Resource": "*",
-            "Condition": {
-                "StringLike": {
-                    "aws:SourceArn": "arn:aws:comprehend:*"
+###### Example KMS key policy to allow access to the Amazon Comprehend service (alternative 2).
@@ -140,21 +130 @@ The following example policy authorizes user **ExampleUser** from AWS account `4
-                }
-            }
-        },
-        {
-          "Effect": "Allow",
-          "Principal": {
-             "AWS": [
-                    "arn:aws:iam::444455556666:user/ExampleUser",
-                    "arn:aws:iam::123456789012:role/ExampleRole"
-                  ]
-          },
-          "Action": "kms:CreateGrant",
-          "Resource": "*",
-          "Condition": {
-              "StringLike": {
-                  "kms:EncryptionContext:aws:comprehend:arn": "arn:aws:comprehend:*"
-              }
-          }
-        }
-      ]
-    }
+JSON
@@ -162 +131,0 @@ The following example policy authorizes user **ExampleUser** from AWS account `4
-The following example policy authorizes AWS account `444455556666` to access this KMS key via the Amazon Comprehend service, using an alternative syntax to the previous example. 
@@ -164 +133,2 @@ The following example policy authorizes AWS account `444455556666` to access thi
-###### Example KMS key policy to allow access to the Amazon Comprehend service (alternative 2).
+****
+    
@@ -201,0 +173,6 @@ This example specifies the authorized entities in the `Principal` attribute. Res
+JSON
+    
+
+****
+    
+    
@@ -302,0 +281,6 @@ The JSON file for the resource policy contains the following contents:
+JSON
+    
+
+****
+    
+