AWS aws-backup documentation change

Service: aws-backup · 2026-01-10 · Documentation medium

File: aws-backup/latest/devguide/logicallyairgappedvault.md

Summary

Clarified recommendations for customer managed keys (CMK) in logically air-gapped vaults: explicitly advised against using same-account CMK in production and emphasized using keys from another dedicated recovery account.

Security assessment

The change enhances security guidance by explicitly discouraging same-account CMK usage in production environments, which reduces risk of key compromise during account breaches. However, there's no evidence of a specific security vulnerability being addressed.

Diff

diff --git a/aws-backup/latest/devguide/logicallyairgappedvault.md b/aws-backup/latest/devguide/logicallyairgappedvault.md
index be5e9085a..3f1474ca1 100644
--- a//aws-backup/latest/devguide/logicallyairgappedvault.md
+++ b//aws-backup/latest/devguide/logicallyairgappedvault.md
@@ -539 +539,3 @@ The `EncryptionKeyType` field can have the following values:
-  * AWS Backup recommends using AWS owned keys with logically air-gapped vaults. However, if your organization policy requires using a customer managed key, use keys from another account in a secondary organization dedicated to recovery as a best practice. You can reference the blog [ Encrypt AWS Backup logically air-gapped vaults with customer-managed keys](https://aws.amazon.com/blogs/storage/encrypt-aws-backup-logically-air-gapped-vaults-with-customer-managed-keys/) to gather more insights into setting up CMK based logically air-gapped vaults.
+  * AWS Backup recommends using AWS owned keys with logically air-gapped vaults.
+
+  * If your organization policy requires using a customer managed key, AWS does not recommend using keys from the same account, except for testing. For production workloads, use a customer managed key from another account in a secondary organization dedicated to recovery as a best practice. You can reference the blog [ Encrypt AWS Backup logically air-gapped vaults with customer-managed keys](https://aws.amazon.com/blogs/storage/encrypt-aws-backup-logically-air-gapped-vaults-with-customer-managed-keys/) to gather more insights into setting up CMK based logically air-gapped vaults.