AWS connect medium security documentation change
Summary
Added 'task' to KMS key permission requirements for Connect AI agents across multiple sections
Security assessment
The change explicitly adds encryption requirements for a new feature (task handling) by including 'kms:GenerateDataKey*' permissions. This documents necessary encryption controls for new data processing capabilities, preventing potential data exposure. Concrete evidence: Added 'task' to KMS permission requirements in 4 locations.
Diff
diff --git a/connect/latest/adminguide/ai-agent-initial-setup.md b/connect/latest/adminguide/ai-agent-initial-setup.md index 8a35b8478..6caeae2ee 100644 --- a//connect/latest/adminguide/ai-agent-initial-setup.md +++ b//connect/latest/adminguide/ai-agent-initial-setup.md @@ -131 +131 @@ Your customer managed key is created, owned, and managed by you. You have full c -If you choose to set up a KMS key where someone else is the administrator, the key must have a policy that allows `kms:CreateGrant`, `kms:DescribeKey`, and `kms:Decrypt` and `kms:GenerateDataKey*` permissions to the IAM identity using the key to invoke Connect AI agents. To use Connect AI agents with chat and emails, the key policy for your Connect AI agents domain must allow `kms:Decrypt`, `kms:GenerateDataKey*`, and `kms:DescribeKey` permissions to the `connect.amazonaws.com` service principal. +If you choose to set up a KMS key where someone else is the administrator, the key must have a policy that allows `kms:CreateGrant`, `kms:DescribeKey`, and `kms:Decrypt` and `kms:GenerateDataKey*` permissions to the IAM identity using the key to invoke Connect AI agents. To use Connect AI agents with chat, task, and emails, the key policy for your Connect AI agents domain must allow `kms:Decrypt`, `kms:GenerateDataKey*`, and `kms:DescribeKey` permissions to the `connect.amazonaws.com` service principal. @@ -135 +135 @@ If you choose to set up a KMS key where someone else is the administrator, the k -To use Connect AI agents with chat and emails, the key policy for your domain must grant the `connect.amazonaws.com` service principal the following permissions: +To use Connect AI agents with chat, task, and emails, the key policy for your domain must grant the `connect.amazonaws.com` service principal the following permissions: @@ -195 +195 @@ You can use the Amazon Connect default key to encrypt your domain. You can also -To use an existing key with Amazon Connect chats and emails, you must grant the `connect.amazonaws.com` service principal the `kms:Decrypt`, `kms:GenerateDataKey*`, and `kms:DescribeKey` permissions. +To use an existing key with Amazon Connect chats, tasks, and emails, you must grant the `connect.amazonaws.com` service principal the `kms:Decrypt`, `kms:GenerateDataKey*`, and `kms:DescribeKey` permissions. @@ -256 +256 @@ That takes you to the Key Management Service (KMS) console. Follow these steps: -To use Connect AI agents with chats and emails, modify the key policy to allow the `kms:Decrypt`, ` kms:GenerateDataKey*`, and `kms:DescribeKey` permissions to the ` connect.amazonaws.com` service principal. The following code shows a sample policy. +To use Connect AI agents with chats, tasks, and emails, modify the key policy to allow the `kms:Decrypt`, ` kms:GenerateDataKey*`, and `kms:DescribeKey` permissions to the ` connect.amazonaws.com` service principal. The following code shows a sample policy.