AWS fsx medium security documentation change

Service: fsx · 2026-02-13 · Security-related medium

File: fsx/latest/WindowsGuide/self-managed-AD.md

Summary

Modified KMS key policy syntax and removed SecretsManager encryption context condition

Security assessment

Removal of 'kms:EncryptionContext:SecretARN' condition weakens cryptographic access control by eliminating a security context binding. This could allow decryption with KMS key without verifying the secret ARN context, potentially increasing risk of privilege escalation if misconfigured.

Diff

diff --git a/fsx/latest/WindowsGuide/self-managed-AD.md b/fsx/latest/WindowsGuide/self-managed-AD.md
index fb62c02a7..5e107b8fa 100644
--- a//fsx/latest/WindowsGuide/self-managed-AD.md
+++ b//fsx/latest/WindowsGuide/self-managed-AD.md
@@ -319 +319 @@ For **Encryption Key** , create a new key, don't use the AWS default KMS key. Be
-        "Resource": "arn:aws:kms:us-west-2:123456789012:key:*",
+        "Resource": "arn:aws:kms:us-west-2:123456789012:key/*",
@@ -322 +321,0 @@ For **Encryption Key** , create a new key, don't use the AWS default KMS key. Be
-                "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:us-west-2:123456789012:secret:*",