AWS cli documentation change

Service: cli · 2026-05-01 · Documentation low

File: cli/latest/reference/payment-cryptography/delete-key.md

Summary

Updated cross-account use note to support resource-based policies and added MPAStatus documentation

Security assessment

The change adds documentation about resource-based policies for cross-account access control and introduces Multi-Party Approval (MPA) status tracking. While this enhances security documentation, there's no evidence of a specific vulnerability being addressed.

Diff

diff --git a/cli/latest/reference/payment-cryptography/delete-key.md b/cli/latest/reference/payment-cryptography/delete-key.md
index fe6c6aed6..ce2216732 100644
--- a//cli/latest/reference/payment-cryptography/delete-key.md
+++ b//cli/latest/reference/payment-cryptography/delete-key.md
@@ -13 +13 @@
-  * [next](disable-default-key-replication-regions.html "disable-default-key-replication-regions") |
+  * [next](delete-resource-policy.html "delete-resource-policy") |
@@ -15 +15 @@
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »
@@ -23 +23 @@
-  * [disable-default-key-replication-regions →](disable-default-key-replication-regions.html "next chapter \(use the right arrow\)")
+  * [delete-resource-policy →](delete-resource-policy.html "next chapter \(use the right arrow\)")
@@ -66 +66 @@ You should delete a key only when you are sure that you don’t need to use it a
-> **Cross-account use:** This operation can’t be used across different Amazon Web Services accounts.
+> **Cross-account use:** This operation supports cross-account use when the key has a resource-based policy that grants access. For more information, see [Resource-based policies](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security_iam_resource-based-policies.html) .
@@ -612,0 +613,44 @@ Key -> (structure)
+> 
+> MpaStatus -> (structure)
+>
+>> The Multi-Party Approval (MPA) status for the key, if applicable.
+>> 
+>> MpaSessionArn -> (string) [required]
+>>
+>>> The ARN of the MPA session.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `20`
+>>>   * max: `2048`
+>>>   * pattern: `arn:aws(-[^:]+)?:mpa:[a-z0-9-]{1,20}:[0-9]{12}:session/[a-zA-Z0-9._-]+/[a-zA-Z0-9_-]+`
+>>> 
+
+>> 
+>> Status -> (string) [required]
+>>
+>>> The current status of the MPA session.
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `PENDING`
+>>>   * `APPROVED`
+>>>   * `FAILED`
+>>>   * `CANCELLED`
+>>> 
+
+>> 
+>> InitiationDate -> (timestamp) [required]
+>>
+>>> The date and time when the MPA session was initiated.
+>> 
+>> StatusMessage -> (string)
+>>
+>>> The message providing additional information about the MPA session status.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `0`
+>>>   * max: `1000`
+>>> 
+
@@ -615 +659 @@ Key -> (structure)
-  * [disable-default-key-replication-regions →](disable-default-key-replication-regions.html "next chapter \(use the right arrow\)")
+  * [delete-resource-policy →](delete-resource-policy.html "next chapter \(use the right arrow\)")
@@ -622 +666 @@ Key -> (structure)
-  * [next](disable-default-key-replication-regions.html "disable-default-key-replication-regions") |
+  * [next](delete-resource-policy.html "delete-resource-policy") |
@@ -624 +668 @@ Key -> (structure)
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »