AWS cli documentation change

Service: cli · 2026-04-28 · Documentation low

File: cli/latest/reference/kms/decrypt.md

Summary

Clarified cross-account key specification requirements and added security best practice guidance

Security assessment

Enhanced documentation about key identifiers (ARNs vs short IDs) for cross-account decryption. While this improves security clarity, there's no evidence of a specific vulnerability being addressed. The change promotes better security practices by recommending explicit ARNs.

Diff

diff --git a/cli/latest/reference/kms/decrypt.md b/cli/latest/reference/kms/decrypt.md
index b83be42af..72828ab97 100644
--- a//cli/latest/reference/kms/decrypt.md
+++ b//cli/latest/reference/kms/decrypt.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.37 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
@@ -82 +82 @@ The KMS key that you use for this operation must be in a compatible key state. F
-> **Cross-account use** : Yes. If you use the `KeyId` parameter to identify a KMS key in a different Amazon Web Services account, specify the key ARN or the alias ARN of the KMS key.
+> **Cross-account use** : Yes. To specify a KMS key in a different Amazon Web Services account, use the [key ARN](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) or [alias ARN](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-alias-ARN) . A short [key ID](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id) is also acceptable when decrypting symmetric ciphertexts, though using a full key ARN is recommended to be more explicit about the intended KMS key.
@@ -210 +210 @@ Syntax:
-> To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with `"alias/"` . To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.
+> To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with `"alias/"` . To specify a KMS key in a different Amazon Web Services account, you should use the key ARN or alias ARN.
@@ -602 +602 @@ KeyMaterialId -> (string)
-  * [AWS CLI 2.34.37 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.38 Command Reference](../../index.html) »