AWS cli documentation change
Summary
Clarified cross-account key specification requirements and added security best practice guidance
Security assessment
Enhanced documentation about key identifiers (ARNs vs short IDs) for cross-account re-encryption. This improves security documentation by recommending explicit key ARNs but doesn't address a specific vulnerability.
Diff
diff --git a/cli/latest/reference/kms/re-encrypt.md b/cli/latest/reference/kms/re-encrypt.md index 6905d6aef..4c259a490 100644 --- a//cli/latest/reference/kms/re-encrypt.md +++ b//cli/latest/reference/kms/re-encrypt.md @@ -15 +15 @@ - * [AWS CLI 2.34.37 Command Reference](../../index.html) » + * [AWS CLI 2.34.38 Command Reference](../../index.html) » @@ -78 +78 @@ The KMS key that you use for this operation must be in a compatible key state. F -> **Cross-account use** : Yes. The source KMS key and destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a different account than the caller. To specify a KMS key in a different account, you must use its key ARN or alias ARN. +> **Cross-account use** : Yes. The source KMS key and destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a different account than the caller. To specify a KMS key in a different account, use the [key ARN](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) or [alias ARN](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-alias-ARN) . A short [key ID](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id) is also acceptable for the source key when decrypting symmetric ciphertexts, though using a full key ARN is recommended to be more explicit about the intended KMS key. @@ -187 +187 @@ JSON Syntax: -> To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with `"alias/"` . To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN. +> To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with `"alias/"` . To specify a KMS key in a different Amazon Web Services account, you should use the key ARN or alias ARN. @@ -637 +637 @@ DestinationKeyMaterialId -> (string) - * [AWS CLI 2.34.37 Command Reference](../../index.html) » + * [AWS CLI 2.34.38 Command Reference](../../index.html) »