AWS AmazonS3 documentation change

Service: AmazonS3 · 2026-04-04 · Documentation medium

File: AmazonS3/latest/userguide/tables-require-kms.md

Summary

Significantly expanded IAM policy examples for enforcing KMS encryption on S3 Tables operations, splitting into multiple policy statements with more granular controls

Security assessment

This change provides more comprehensive IAM policy examples for enforcing KMS encryption on S3 Tables operations. It adds security documentation about encryption enforcement but doesn't address a specific security vulnerability or incident. The expanded examples show better security practices with separate policy statements for algorithm and key enforcement.

Diff

diff --git a/AmazonS3/latest/userguide/tables-require-kms.md b/AmazonS3/latest/userguide/tables-require-kms.md
index 16038db6b..b87226bdf 100644
--- a//AmazonS3/latest/userguide/tables-require-kms.md
+++ b//AmazonS3/latest/userguide/tables-require-kms.md
@@ -14,3 +13,0 @@ JSON
-****
-    
-    
@@ -22 +19,17 @@ JSON
-          "Sid": "EnforceKMSEncryption",
+          "Sid": "EnforceKMSEncryptionAlgorithm",
+          "Effect": "Deny",
+          "Principal": "*",
+          "Action": [
+            "s3tables:CreateTable"
+          ],
+          "Resource": [
+            "arn:aws:s3tables:us-west-2:111122223333:bucket/example-table-bucket/*"
+          ],
+          "Condition": {
+            "StringNotEquals": {
+              "s3tables:sseAlgorithm": "aws:kms"
+            }
+          }
+        },
+        {
+          "Sid": "EnforceKMSEncryptionKey",
@@ -33 +45,0 @@ JSON
-              "s3tables:sseAlgorithm": "aws:kms",
@@ -47,0 +59,15 @@ This IAM identity policy requires users to use a specific AWS KMS key for encryp
+        {
+          "Sid": "RequireSSEKMSOnTables",
+          "Action": [
+              "s3tables:CreateTableBucket",
+              "s3tables:PutTableBucketEncryption",
+              "s3tables:CreateTable"
+          ],
+          "Effect": "Deny",
+          "Resource": "*",
+          "Condition": {
+            "StringNotEquals": {
+                "s3tables:sseAlgorithm": "aws:kms"
+            }
+          }
+        },
@@ -54 +80 @@ This IAM identity policy requires users to use a specific AWS KMS key for encryp
-          ]
+          ],
@@ -59 +84,0 @@ This IAM identity policy requires users to use a specific AWS KMS key for encryp
-                "s3tables:sseAlgorithm": "aws:kms",