AWS dms: Add IAM trust policy guidance for Kerberos KeyCacheSecretIamArn role

Service: dms · 2026-09-27 · Documentation medium

File: dms/latest/userguide/CHAP_Security.Kerberos.md · Type: iam

Summary

Added a note that the KeyCacheSecretIamArn role must be in the same account as the replication instance, and an important note to add the aws:SourceAccount condition to the role trust policy to prevent the cross-service confused deputy problem.

Security assessment

Documents an IAM trust policy hardening measure (aws:SourceAccount condition) to prevent cross-service confused deputy attacks when DMS assumes a customer role; this is security best-practice documentation rather than a fix for a specific disclosed vulnerability.

Evidence

Because AWS DMS assumes this role on your behalf, add the `aws:SourceAccount` global condition context key to the role's trust policy. This condition allows AWS DMS to assume the role only for replication instances in your own account, and helps protect the role against the cross-service confused deputy problem. For more information, see [Cross-service confused deputy prevention](./cross-service-confused-deputy-prevention.html).

Diff

diff --git a/dms/latest/userguide/CHAP_Security.Kerberos.md b/dms/latest/userguide/CHAP_Security.Kerberos.md
index f2a47bd05..e962e8647 100644
--- a//dms/latest/userguide/CHAP_Security.Kerberos.md
+++ b//dms/latest/userguide/CHAP_Security.Kerberos.md
@@ -70,0 +71,8 @@ For more information about the MIT **kutil** utility, see [kutil](https://web.mi
+###### Note
+
+The IAM role that you specify for `KeyCacheSecretIamArn` must belong to the same AWS account that creates or modifies the replication instance. If you specify a role from a different account, the request fails.
+
+###### Important
+
+Because AWS DMS assumes this role on your behalf, add the `aws:SourceAccount` global condition context key to the role's trust policy. This condition allows AWS DMS to assume the role only for replication instances in your own account, and helps protect the role against the cross-service confused deputy problem. For more information, see [Cross-service confused deputy prevention](./cross-service-confused-deputy-prevention.html).
+