AWS Security ChangesHomeSearch

AWS iot medium security documentation change

Service: iot · 2026-05-19 · Security-related medium

File: iot/latest/developerguide/kafka-vpc-destination.md

Summary

Reduced auto-disable period for inactive Kafka VPC destinations from 30 to 7 days

Security assessment

Shorter inactivity window (30→7 days) reduces exposure of unused resources, mitigating potential attack surface. Directly impacts security posture by limiting persistent unused endpoints.

Diff

diff --git a/iot/latest/developerguide/kafka-vpc-destination.md b/iot/latest/developerguide/kafka-vpc-destination.md
index 2c2cc286a..70e1c536a 100644
--- a//iot/latest/developerguide/kafka-vpc-destination.md
+++ b//iot/latest/developerguide/kafka-vpc-destination.md
@@ -27 +27 @@ If the Apache Kafka Virtual Private Cloud (VPC) destination is disabled and then
-  * If an Apache Kafka Virtual Private Cloud (VPC) destination doesn't receive any traffic for 30 days in a row, it will be disabled.
+  * If an Apache Kafka Virtual Private Cloud (VPC) destination doesn't receive any traffic for 7 days in a row, it will be disabled.