AWS lambda documentation change
Summary
Updated IAM permission wording, added support for customer managed keys (CMK) for encryption, modified checkpoint data details, and added reference to encryption documentation.
Security assessment
Introduction of CMK support improves security posture but lacks evidence of patching a vulnerability. Changes describe security enhancements rather than fixing known issues.
Diff
diff --git a/lambda/latest/dg/durable-security.md b/lambda/latest/dg/durable-security.md index ebca32f17..698d46195 100644 --- a//lambda/latest/dg/durable-security.md +++ b//lambda/latest/dg/durable-security.md @@ -11 +11 @@ Execution role permissionsState encryptionCloudTrail loggingCross-account consid -Lambda durable functions require specific IAM permissions to manage checkpoint operations. Follow the principle of least privilege by granting only the permissions your function needs. +AWS Lambda durable functions require specific IAM permissions to manage checkpoint operations. Follow the principle of least privilege by granting only the permissions your function needs. @@ -78 +78 @@ Alternatively, you can use the AWS managed policy `AWSLambdaBasicDurableExecutio -Lambda durable functions automatically enable encryption at rest using AWS owned keys at no charge. Each function execution maintains isolated state that other executions cannot access. Customer managed keys (CMK) are not supported. +Lambda durable functions encrypt execution data at rest. Each function execution maintains isolated state that other executions cannot access. You can configure a customer managed key to encrypt durable execution data. For more information, see [Encrypting AWS Lambda durable execution data](./durable-encryption.html). @@ -82 +82 @@ Checkpoint data includes: - * Step results and return values + * Step results and errors @@ -84 +84 @@ Checkpoint data includes: - * Execution progress and timeline + * Chained invoke inputs @@ -86 +85,0 @@ Checkpoint data includes: - * Wait state information @@ -89,0 +89 @@ Checkpoint data includes: +For the complete list of durable execution data encrypted at rest, see [What is encrypted](./durable-encryption.html#durable-encryption-what-is-encrypted). @@ -155 +155 @@ Examples -Durable execution SDK +Encrypting durable execution data