AWS firehose high security documentation change
Summary
Added explicit KMS permission requirements for CUSTOMER_MANAGED_CMK encryption
Security assessment
Clarifies critical permissions (GenerateDataKey, Decrypt, CreateGrant) required to avoid encryption failures, directly addressing potential misconfigurations.
Diff
diff --git a/firehose/latest/dev/encryption.md b/firehose/latest/dev/encryption.md index 9de5383ec..56ad096df 100644 --- a//firehose/latest/dev/encryption.md +++ b//firehose/latest/dev/encryption.md @@ -30,0 +31,2 @@ You can also enable SSE when you create the Firehose stream. To do that, specify +To successfully use `CUSTOMER_MANAGED_CMK`, both the caller's IAM policy and the KMS key policy must allow `kms:GenerateDataKey` and `kms:Decrypt` operations. Firehose validates these permissions when you call PutRecord or PutRecordBatch with `CUSTOMER_MANAGED_CMK` encryption. Additionally, `kms:CreateGrant` permission is required when calling CreateDeliveryStream or StartDeliveryStreamEncryption with `CUSTOMER_MANAGED_CMK` encryption. +