AWS waf medium security documentation change

Service: waf · 2026-05-28 · Security-related medium

File: waf/latest/developerguide/classic-using-service-linked-roles.md

Summary

Added kms:GenerateDataKey and kms:Decrypt permissions for KMS encryption support

Security assessment

Documents required permissions for customer-managed KMS encryption, directly enabling security feature implementation (encryption at rest). Missing these permissions would prevent proper encryption.

Diff

diff --git a/waf/latest/developerguide/classic-using-service-linked-roles.md b/waf/latest/developerguide/classic-using-service-linked-roles.md
index 8683b7587..af1cbb412 100644
--- a//waf/latest/developerguide/classic-using-service-linked-roles.md
+++ b//waf/latest/developerguide/classic-using-service-linked-roles.md
@@ -58,0 +59,2 @@ The permissions policies of the roles allow AWS WAF Classic to complete the foll
+  * Action: `kms:GenerateDataKey` and `kms:Decrypt` on AWS Key Management Service to allow Amazon Data Firehose to use customer managed AWS KMS keys to encrypt data.
+