AWS cli high security documentation change

Service: cli · 2026-01-31 · Security-related high

File: cli/latest/reference/s3control/create-job.md

Summary

Added documentation for S3UpdateObjectEncryption operation with KMS key configuration and Bucket Key enablement

Security assessment

Introduces documentation for updating server-side encryption types (SSE-S3 to SSE-KMS), KMS key rotation compliance, and S3 Bucket Keys - critical security features for data encryption management. Includes required KMS ARN pattern validation (20-2048 characters) and explicit encryption controls

Diff

diff --git a/cli/latest/reference/s3control/create-job.md b/cli/latest/reference/s3control/create-job.md
index 572445e7f..f9ed4891d 100644
--- a//cli/latest/reference/s3control/create-job.md
+++ b//cli/latest/reference/s3control/create-job.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.12 Command Reference](../../index.html) »
@@ -847,0 +848,28 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3cont
+> 
+> S3UpdateObjectEncryption -> (structure)
+>
+>> Updates the server-side encryption type of an existing encrypted object in a general purpose bucket. You can use the `UpdateObjectEncryption` operation to change encrypted objects from server-side encryption with Amazon S3 managed keys (SSE-S3) to server-side encryption with Key Management Service (KMS) keys (SSE-KMS), or to apply S3 Bucket Keys. You can also use the `UpdateObjectEncryption` operation to change the customer-managed KMS key used to encrypt your data so that you can comply with custom key-rotation standards.
+>> 
+>> ObjectEncryption -> (structure)
+>>
+>>> The updated server-side encryption type for this S3 object. The `UpdateObjectEncryption` operation supports the SSE-KMS encryption type.
+>>> 
+>>> SSEKMS -> (structure)
+>>>
+>>>> Specifies to update the object encryption type to server-side encryption with Key Management Service (KMS) keys (SSE-KMS).
+>>>> 
+>>>> KMSKeyArn -> (string) [required]
+>>>>
+>>>>> Specifies the Amazon Web Services KMS key Amazon Resource Name (ARN) to use for the updated server-side encryption type. Required if `UpdateObjectEncryption` specifies `SSEKMS` .
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `20`
+>>>>>   * max: `2048`
+>>>>>   * pattern: `arn:aws[a-zA-Z0-9-]*:kms:[a-z0-9-]+:[0-9]{12}:key/[a-zA-Z0-9-]+`
+>>>>> 
+
+>>>> 
+>>>> BucketKeyEnabled -> (boolean)
+>>>>
+>>>>> Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS). If this value isn’t specified, it defaults to `false` . Setting this value to `true` causes Amazon S3 to use an S3 Bucket Key for update object encryption with SSE-KMS.
@@ -963,0 +992,8 @@ JSON Syntax:
+      },
+      "S3UpdateObjectEncryption": {
+        "ObjectEncryption": {
+          "SSEKMS": {
+            "KMSKeyArn": "string",
+            "BucketKeyEnabled": true|false
+          }
+        }
@@ -1494,2 +1530,2 @@ JSON Syntax:
->>>>>>>   * min: `1`
->>>>>>>   * max: `2000`
+>>>>>>>   * min: `20`
+>>>>>>>   * max: `2048`
@@ -1514,2 +1550,2 @@ JSON Syntax:
->>>>>>>   * min: `1`
->>>>>>>   * max: `2000`
+>>>>>>>   * min: `20`
+>>>>>>>   * max: `2048`
@@ -1744 +1780 @@ JobId -> (string)
-  * [AWS CLI 2.33.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.12 Command Reference](../../index.html) »