AWS opensearch-service medium security documentation change

Service: opensearch-service · 2026-01-10 · Security-related medium

File: opensearch-service/latest/developerguide/serverless-encryption.md

Summary

Restructured KMS policy: Added explicit kms:DescribeKey permission and granular conditions for CreateGrant

Security assessment

Added explicit kms:DescribeKey permission and service-specific conditions (kms:ViaService) with restricted GrantOperations (Decrypt, GenerateDataKey). This implements least-privilege access controls for encryption keys, reducing attack surface by preventing overly permissive grants.

Diff

diff --git a/opensearch-service/latest/developerguide/serverless-encryption.md b/opensearch-service/latest/developerguide/serverless-encryption.md
index 6c31d8890..5771709eb 100644
--- a//opensearch-service/latest/developerguide/serverless-encryption.md
+++ b//opensearch-service/latest/developerguide/serverless-encryption.md
@@ -187,0 +188 @@ JSON
+            "Action": "kms:DescribeKey",
@@ -189,4 +190,3 @@ JSON
-          "Action": [
-            "kms:DescribeKey",
-            "kms:CreateGrant"
-          ],
+            "Principal": {
+                "AWS": "arn:aws:iam::123456789012:user/Dale"
+            },
@@ -196,0 +197,19 @@ JSON
+                }
+            }
+        },
+        {
+            "Action": "kms:CreateGrant",
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::123456789012:user/Dale"
+            },
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "kms:ViaService": "aoss.us-east-1.amazonaws.com"
+                },
+                "ForAllValues:StringEquals": {
+                    "kms:GrantOperations": [
+                        "Decrypt",
+                        "GenerateDataKey"
+                    ]