AWS kms documentation change
Summary
Added cross-account VPC endpoint service requirement note about permissions
Security assessment
The added note about cross-account permissions requirements improves security documentation but doesn't indicate a specific security issue being addressed. It reinforces proper configuration practices rather than fixing a vulnerability.
Diff
diff --git a/kms/latest/developerguide/choose-xks-connectivity.md b/kms/latest/developerguide/choose-xks-connectivity.md index 1026b65ce..5d7d5769c 100644 --- a//kms/latest/developerguide/choose-xks-connectivity.md +++ b//kms/latest/developerguide/choose-xks-connectivity.md @@ -11 +11,10 @@ Before creating your external key store, choose the connectivity option that det -If you are creating an external key store, you need to determine how AWS KMS communicates with your [external key store proxy](./keystore-external.html#concept-xks-proxy). This choice will determine which components you need and how you configure them. AWS KMS supports the following connectivity options. Choose the option that meets your performance and security goals. +If you are creating an external key store, you need to determine how AWS KMS communicates with your [external key store proxy](./keystore-external.html#concept-xks-proxy). This choice will determine which components you need and how you configure them. AWS KMS supports the following connectivity options. + + * Public endpoint connectivity + + * VPC endpoint service connectivity + + + + +Choose the option that meets your performance and security goals. @@ -15 +24,6 @@ Before you begin, [confirm that you need an external key store](./keystore-exter -###### Note +###### Considerations + + * If your external key store proxy is built into your external key manager, your connectivity might be predetermined. For guidance, consult the documentation for your external key manager or external key store proxy. + + * You can [change your external key store proxy connectivity option](./update-xks-keystore.html) even on an operating external key store. However, the process must be carefully planned and executed to minimize disruption, avoid errors, and ensure continued access to the cryptographic keys that encrypt your data. + @@ -17 +30,0 @@ Before you begin, [confirm that you need an external key store](./keystore-exter -If your external key store proxy is built into your external key manager, your connectivity might be predetermined. For guidance, consult the documentation for your external key manager or external key store proxy. @@ -19 +31,0 @@ If your external key store proxy is built into your external key manager, your c -You can [change your external key store proxy connectivity option](./update-xks-keystore.html) even on an operating external key store. However, the process must be carefully planned and executed to minimize disruption, avoid errors, and ensure continued access to the cryptographic keys that encrypt your data. @@ -62 +74 @@ You can locate your external key store proxy in your Amazon VPC. -Or, locate your external key store proxy outside of AWS and use your Amazon VPC endpoint service only for secure communication with AWS KMS. +Alternatively, you can locate your external key store proxy outside of AWS Cloud and use your Amazon VPC endpoint service only for secure communication with AWS KMS. @@ -65,0 +78,2 @@ Or, locate your external key store proxy outside of AWS and use your Amazon VPC +You can also connect an external key store to an Amazon VPC endpoint service owned by another AWS account. Both AWS accounts need the [necessary permissions](./authorize-xks-key-store.html#authorize-xks-managers) to allow communications between AWS KMS and the VPC endpoint service +