AWS controltower: Require key policy on each multi-Region KMS replica key
Summary
Adds guidance that a key policy must be set on each multi-Region replica key and links to KMS replica key creation docs.
Security assessment
The added line documents a KMS key-policy requirement for multi-Region replica keys, which is encryption/access-control best practice for backup encryption; it is guidance rather than a fix for a specific vulnerability.
Evidence
+Your multi-region AWS KMS key must be replicated for every AWS Region that you plan to govern with AWS Control Tower. You must set a key policy on each multi-Region replica key. For information about how to create replica keys, see [Create multi-Region replica keys](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-replicate.html#create-replica-keys).
Diff
diff --git a/controltower/latest/userguide/backup-prerequisites.md b/controltower/latest/userguide/backup-prerequisites.md index 05c194a4d..fe7bbac52 100644 --- a//controltower/latest/userguide/backup-prerequisites.md +++ b//controltower/latest/userguide/backup-prerequisites.md @@ -79 +79 @@ This example policy gives all accounts in your organization access to their encr -Your multi-region AWS KMS key must be replicated for every AWS Region that you plan to govern with AWS Control Tower. +Your multi-region AWS KMS key must be replicated for every AWS Region that you plan to govern with AWS Control Tower. You must set a key policy on each multi-Region replica key. For information about how to create replica keys, see [Create multi-Region replica keys](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-replicate.html#create-replica-keys).