AWS emr medium security documentation change
Summary
Added tip about enabling S3 Bucket Keys to reduce KMS costs, including policy considerations when changing encryption context.
Security assessment
The change documents security implications of encryption context changes (ARN format shift) that could break existing IAM/KMS policies. It explicitly warns about access control impacts and references security policies, meeting criteria for security-related documentation. It provides guidance for maintaining secure configurations when enabling cost optimization features.
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/data-protection.md b/emr/latest/EMR-Serverless-UserGuide/data-protection.md index ec1a070b0..8205374fd 100644 --- a//emr/latest/EMR-Serverless-UserGuide/data-protection.md +++ b//emr/latest/EMR-Serverless-UserGuide/data-protection.md @@ -62,0 +63,4 @@ You can choose between two different key management systems when you specify SSE +###### Tip + +To reduce AWS KMS costs when using SSE-KMS, consider enabling Amazon S3 Bucket Keys on your Amazon S3 buckets. Amazon S3 Bucket Keys use a short-lived bucket-level key to reduce AWS KMS API calls by up to 99 percent. Before enabling Amazon S3 Bucket Keys, review your IAM and AWS KMS key policies – the encryption context changes from the Amazon S3 object ARN to the bucket ARN, which may affect policies that use the object ARN for access control. For more information, see [Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html) in the _Amazon Simple Storage Service User Guide_. +