AWS whitepapers documentation change
Summary
Changed 'ELB' to 'Elastic Load Balancing' in IAM Forward Access Sessions reference
Security assessment
Acronym expansion in existing security context. No modification to KMS grants or volume encryption mechanisms described.
Diff
diff --git a/whitepapers/latest/security-design-of-aws-nitro-system/putting-the-pieces-together-ebs-volume-attachment.md b/whitepapers/latest/security-design-of-aws-nitro-system/putting-the-pieces-together-ebs-volume-attachment.md index 3bfdfa83e..053e50a82 100644 --- a//whitepapers/latest/security-design-of-aws-nitro-system/putting-the-pieces-together-ebs-volume-attachment.md +++ b//whitepapers/latest/security-design-of-aws-nitro-system/putting-the-pieces-together-ebs-volume-attachment.md @@ -13 +13 @@ The EC2 control plane allocates the PCIe device resources of the Nitro Card for -Assuming that the customer IAM identity that made the `AttachVolume` command is also authorized to make a Decrypt command in AWS KMS under the expected AWS KMS key, the encrypted volume’s data key will be decrypted. The Nitro System's access to this operation is protected by [AWS KMS Grants](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html) and by IAM Forward Access Sessions. (Refer to this [explanation of IAM Forward Access Sessions](https://youtu.be/2ZeUBbZPUWs?t=1919) in the context of ELB, AWS Certificate Manager and AWS Key Management Service in a presentation by Colm MacCárthaigh, VP and Distinguished Engineer at AWS.) +Assuming that the customer IAM identity that made the `AttachVolume` command is also authorized to make a Decrypt command in AWS KMS under the expected AWS KMS key, the encrypted volume’s data key will be decrypted. The Nitro System's access to this operation is protected by [AWS KMS Grants](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html) and by IAM Forward Access Sessions. (Refer to this [explanation of IAM Forward Access Sessions](https://youtu.be/2ZeUBbZPUWs?t=1919) in the context of Elastic Load Balancing, AWS Certificate Manager and AWS Key Management Service in a presentation by Colm MacCárthaigh, VP and Distinguished Engineer at AWS.)