AWS kms documentation change
Summary
Added new condition keys for CreateGrant (kms:GrantConstraintSourceArn, kms:GranteeServicePrincipal, kms:RetiringServicePrincipal), added key last usage condition (kms:TrailingDaysWithoutKeyUsage) for DisableKey and ScheduleKeyDeletion, and documented new GetKeyLastUsage API.
Security assessment
The changes enhance documentation for granular access control conditions (like service principal restrictions) and introduce auditing capabilities for key usage patterns. While these improve security posture by enabling better policy enforcement and inactivity monitoring, there's no evidence of a specific vulnerability being patched.
Diff
diff --git a/kms/latest/developerguide/kms-api-permissions-reference.md b/kms/latest/developerguide/kms-api-permissions-reference.md index 3b5933150..91e0b2b84 100644 --- a//kms/latest/developerguide/kms-api-permissions-reference.md +++ b//kms/latest/developerguide/kms-api-permissions-reference.md @@ -33 +33 @@ Key policy (for the KMS key) | No | KMS key | _Conditions for KMS key operatio -[CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html) `kms:CreateGrant` | Key policy | Yes | KMS key | _Encryption context conditions:_ [kms:EncryptionContext:context-key](./conditions-kms.html#conditions-kms-encryption-context-keys) [kms:EncryptionContextKeys](./conditions-kms.html#conditions-kms-encryption-context-keys) _Grant conditions:_ [kms:GrantConstraintType](./conditions-kms.html#conditions-kms-grant-constraint-type) [kms:GranteePrincipal](./conditions-kms.html#conditions-kms-grantee-principal)[kms:GrantIsForAWSResource](./conditions-kms.html#conditions-kms-grant-is-for-aws-resource) [kms:GrantOperations](./conditions-kms.html#conditions-kms-grant-operations)[kms:RetiringPrincipal](./conditions-kms.html#conditions-kms-retiring-principal) _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) +[CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html) `kms:CreateGrant` | Key policy | Yes | KMS key | _Encryption context conditions:_ [kms:EncryptionContext:context-key](./conditions-kms.html#conditions-kms-encryption-context-keys) [kms:EncryptionContextKeys](./conditions-kms.html#conditions-kms-encryption-context-keys) _Grant conditions:_ [kms:GrantConstraintSourceArn](./conditions-kms.html#conditions-kms-grant-constraint-source-arn) [kms:GrantConstraintType](./conditions-kms.html#conditions-kms-grant-constraint-type) [kms:GranteePrincipal](./conditions-kms.html#conditions-kms-grantee-principal) [kms:GranteeServicePrincipal](./conditions-kms.html#conditions-kms-grantee-service-principal) [kms:GrantIsForAWSResource](./conditions-kms.html#conditions-kms-grant-is-for-aws-resource) [kms:GrantOperations](./conditions-kms.html#conditions-kms-grant-operations) [kms:RetiringPrincipal](./conditions-kms.html#conditions-kms-retiring-principal) [kms:RetiringServicePrincipal](./conditions-kms.html#conditions-kms-retiring-service-principal) _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) @@ -48 +48 @@ Key policy (for the KMS key) | No | KMS key | _Conditions for KMS key operation -[DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html) `kms:DisableKey` | Key policy | No | KMS key | _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) +[DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html) `kms:DisableKey` | Key policy | No | KMS key | _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) _Key last usage condition:_ [kms:TrailingDaysWithoutKeyUsage](./conditions-kms.html#conditions-kms-trailing-days-without-key-usage) @@ -59,0 +60 @@ Key policy (for the KMS key) | No | KMS key | _Conditions for KMS key operation +[GetKeyLastUsage](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyLastUsage.html) `kms:GetKeyLastUsage` | Key policy | No | KMS key | _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) @@ -88 +89 @@ Key policy (for the KMS key) | No | KMS key | _Conditions for KMS key operation -[ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html) `kms:ScheduleKeyDeletion` | Key policy | No | KMS key | _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) +[ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html) `kms:ScheduleKeyDeletion` | Key policy | No | KMS key | _Conditions for KMS key operations:_[kms:CallerAccount](./conditions-kms.html#conditions-kms-caller-account) [kms:KeySpec](./conditions-kms.html#conditions-kms-key-spec) [kms:KeyUsage](./conditions-kms.html#conditions-kms-key-usage) [kms:KeyOrigin](./conditions-kms.html#conditions-kms-key-origin) [kms:MultiRegion](./conditions-kms.html#conditions-kms-multiregion) [kms:MultiRegionKeyType](./conditions-kms.html#conditions-kms-multiregion-key-type) [kms:ResourceAliases](./conditions-kms.html#conditions-kms-resource-aliases) [aws:ResourceTag/_tag-key_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) (AWS global condition key) [kms:ViaService](./conditions-kms.html#conditions-kms-via-service) _Key last usage condition:_ [kms:TrailingDaysWithoutKeyUsage](./conditions-kms.html#conditions-kms-trailing-days-without-key-usage)