AWS kms documentation change
Summary
Added release note for service principal grants feature with new parameters and constraints.
Security assessment
Documents new security capabilities (service principal grants, SourceArn constraints) but doesn't address any specific security incident.
Diff
diff --git a/kms/latest/developerguide/dochistory.md b/kms/latest/developerguide/dochistory.md index 984f9e5b2..606e4fd3e 100644 --- a//kms/latest/developerguide/dochistory.md +++ b//kms/latest/developerguide/dochistory.md @@ -29,0 +30 @@ Change| Description| Date +[Service principal grants](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html)| AWS KMS now supports creating grants for AWS service principals. You can use the new `GranteeServicePrincipal` and `RetiringServicePrincipal` parameters in the `CreateGrant` operation to specify a service principal as the grantee or retiring principal of a grant. This release also introduces the `SourceArn` grant constraint, which restricts grant permissions to requests made on behalf of a specific AWS resource. Three new condition keys are available for `CreateGrant` requests: `kms:GranteeServicePrincipal`, `kms:RetiringServicePrincipal`, and `kms:GrantConstraintSourceArn`. For more information, see [Grants in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html).| March 6, 2026