AWS cli medium security documentation change

Service: cli · 2026-05-01 · Security-related medium

File: cli/latest/reference/payment-cryptography/add-key-replication-regions.md

Summary

Added cross-account policy documentation and MPA status tracking with session details

Security assessment

Added documentation for resource-based cross-account access policies and Multi-Party Approval (MPA) workflow tracking. These directly relate to security controls (access management and cryptographic key approval processes). The MPA status fields provide visibility into authorization states which is critical for security auditing.

Diff

diff --git a/cli/latest/reference/payment-cryptography/add-key-replication-regions.md b/cli/latest/reference/payment-cryptography/add-key-replication-regions.md
index 10adb4b35..3cf70185b 100644
--- a//cli/latest/reference/payment-cryptography/add-key-replication-regions.md
+++ b//cli/latest/reference/payment-cryptography/add-key-replication-regions.md
@@ -13 +13 @@
-  * [next](create-alias.html "create-alias") |
+  * [next](associate-mpa-team.html "associate-mpa-team") |
@@ -15 +15 @@
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »
@@ -23 +23 @@
-  * [create-alias →](create-alias.html "next chapter \(use the right arrow\)")
+  * [associate-mpa-team →](associate-mpa-team.html "next chapter \(use the right arrow\)")
@@ -65 +65 @@ The key must be in an active state to add Replication Regions. You can add multi
-> **Cross-account use:** This operation can’t be used across different Amazon Web Services accounts.
+> **Cross-account use:** This operation supports cross-account use when the key has a resource-based policy that grants access. For more information, see [Resource-based policies](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security_iam_resource-based-policies.html) .
@@ -574,0 +575,44 @@ Key -> (structure)
+> 
+> MpaStatus -> (structure)
+>
+>> The Multi-Party Approval (MPA) status for the key, if applicable.
+>> 
+>> MpaSessionArn -> (string) [required]
+>>
+>>> The ARN of the MPA session.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `20`
+>>>   * max: `2048`
+>>>   * pattern: `arn:aws(-[^:]+)?:mpa:[a-z0-9-]{1,20}:[0-9]{12}:session/[a-zA-Z0-9._-]+/[a-zA-Z0-9_-]+`
+>>> 
+
+>> 
+>> Status -> (string) [required]
+>>
+>>> The current status of the MPA session.
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `PENDING`
+>>>   * `APPROVED`
+>>>   * `FAILED`
+>>>   * `CANCELLED`
+>>> 
+
+>> 
+>> InitiationDate -> (timestamp) [required]
+>>
+>>> The date and time when the MPA session was initiated.
+>> 
+>> StatusMessage -> (string)
+>>
+>>> The message providing additional information about the MPA session status.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `0`
+>>>   * max: `1000`
+>>> 
+
@@ -577 +621 @@ Key -> (structure)
-  * [create-alias →](create-alias.html "next chapter \(use the right arrow\)")
+  * [associate-mpa-team →](associate-mpa-team.html "next chapter \(use the right arrow\)")
@@ -584 +628 @@ Key -> (structure)
-  * [next](create-alias.html "create-alias") |
+  * [next](associate-mpa-team.html "associate-mpa-team") |
@@ -586 +630 @@ Key -> (structure)
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »