AWS kms documentation change

Service: kms · 2026-05-22 · Documentation low

File: kms/latest/developerguide/ct-creategrant.md

Summary

Added new example log entry for service principal grants with SourceArn constraint and clarified CloudTrail field differences for service principals.

Security assessment

The change documents new grant constraints (SourceArn) and service principal handling in CloudTrail logs, improving visibility into access controls. However, there's no evidence of a security vulnerability being fixed.

Diff

diff --git a/kms/latest/developerguide/ct-creategrant.md b/kms/latest/developerguide/ct-creategrant.md
index b3c5e322c..b182f1970 100644
--- a//kms/latest/developerguide/ct-creategrant.md
+++ b//kms/latest/developerguide/ct-creategrant.md
@@ -12,0 +13,2 @@ CloudTrail log entries for this operation recorded on or after December 2022 inc
+The following example shows a `CreateGrant` log entry for a grant with an encryption context constraint.
+    
@@ -37,3 +39,5 @@ CloudTrail log entries for this operation recorded on or after December 2022 inc
-          "operations": ["Encrypt",
-          "RetireGrant"],
-          "granteePrincipal": "EX_PRINCIPAL_ID"
+          "operations": [
+            "Encrypt",
+            "RetireGrant"
+          ],
+          "granteePrincipal": "service-name.amazonaws.com"
@@ -55,0 +60,51 @@ CloudTrail log entries for this operation recorded on or after December 2022 inc
+The following example shows a `CreateGrant` log entry for a service principal grant. This grant uses the `GranteeServicePrincipal` parameter to specify an AWS service principal as the grantee, and includes a `SourceArn` grant constraint.
+    
+    
+    {
+      "eventVersion": "1.08",
+      "userIdentity": {
+          "type": "IAMUser",
+          "principalId": "EX_PRINCIPAL_ID",
+          "arn": "arn:aws:iam::111122223333:user/Alice",
+          "accountId": "111122223333",
+          "accessKeyId": "EXAMPLE_KEY_ID",
+          "userName": "Alice"
+      },
+      "eventTime": "2026-03-04T18:22:45Z",
+      "eventSource": "kms.amazonaws.com",
+      "eventName": "CreateGrant",
+      "awsRegion": "us-east-1",
+      "sourceIPAddress": "192.0.2.0",
+      "userAgent": "AWS Internal",
+      "requestParameters": {
+          "keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+          "constraints": {
+              "sourceArn": "arn:aws:dynamodb:us-east-1:111122223333:table/ExampleTable"
+          },
+          "operations": [
+            "Encrypt",
+            "Decrypt",
+            "GenerateDataKey"
+          ],
+          "granteeServicePrincipal": "service-name.amazonaws.com",
+          "retiringServicePrincipal": "service-name.amazonaws.com"
+      },
+      "responseElements": {
+          "grantId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+          "keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+      },
+      "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
+      "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
+      "readOnly": false,
+      "resources": [{
+          "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+          "accountId": "111122223333"
+      }],
+      "eventType": "AwsApiCall",
+      "recipientAccountId": "111122223333"
+    }
+
+###### Note
+
+When a grant is created with the `GranteeServicePrincipal` parameter, the CloudTrail log entry for the `CreateGrant` operation includes a `granteeServicePrincipal` field instead of `granteePrincipal`. Similarly, if a `RetiringServicePrincipal` is specified, the log entry includes a `retiringServicePrincipal` field instead of `retiringPrincipal`. This distinguishes grants that were explicitly created with `GranteeServicePrincipal` for an AWS [service principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) from grants where an AWS service is represented in the `granteePrincipal` field.
+