AWS healthlake medium security documentation change

Service: healthlake · 2026-01-13 · Security-related medium

File: healthlake/latest/devguide/managing-fhir-subscriptions-create.md

Summary

Added KMS key tagging requirement and expanded key policy to include healthlake.amazonaws.com service principal for CM_CMK datastores.

Security assessment

Addresses potential access failures by explicitly requiring EventBridgeApiDestinations tag and adding healthlake service to KMS policy. Prevents misconfiguration that could block encrypted data delivery.

Diff

diff --git a/healthlake/latest/devguide/managing-fhir-subscriptions-create.md b/healthlake/latest/devguide/managing-fhir-subscriptions-create.md
index 0deed97c3..3d40c0cc7 100644
--- a//healthlake/latest/devguide/managing-fhir-subscriptions-create.md
+++ b//healthlake/latest/devguide/managing-fhir-subscriptions-create.md
@@ -36,0 +37,2 @@ Example Subscription Topic resource:
+     * If using a CM_CMK datastore, you must add the `EventBridgeApiDestinations` tag to your KMS key with the value of `true`
+
@@ -45 +47 @@ Example KMS key policy if using CM_CMK datastore:
-        "Service": "events.amazonaws.com"
+        "Service": ["events.amazonaws.com", "healthlake.amazonaws.com"]