AWS transcribe: Correct kms:ViaService condition value for transcription jobs
Summary
Updates the ResourceAccessRole IAM policy example so the `kms:ViaService` condition uses the regional transcription service principal `transcribe.us-west-2.amazonaws.com` instead of `transcribe.streaming.amazonaws.com`, and notes the ViaService value is the same for streaming and transcription jobs.
Security assessment
The `kms:ViaService` condition scopes which AWS service may use the customer KMS key; using the wrong service principal value could cause key access to be granted/denied incorrectly, so correcting it matters for encryption key access control. No CVE or incident is referenced, so it is a documentation correction rather than a vulnerability fix.
Evidence
+ "kms:ViaService": "transcribe.us-west-2.amazonaws.com",
Diff
diff --git a/transcribe/latest/dg/health-scribe-encryption-customer.md b/transcribe/latest/dg/health-scribe-encryption-customer.md index 6ed0d1f4d..0318ea416 100644 --- a//transcribe/latest/dg/health-scribe-encryption-customer.md +++ b//transcribe/latest/dg/health-scribe-encryption-customer.md @@ -86 +86 @@ The IAM policy attached to your DataAccessRole or ResourceAccessRole must grant -The following IAM policy example shows how to grant a ResourceAccessRole permissions for AWS HealthScribe streaming. To use this policy for transcription jobs, replace `transcribe.streaming.amazonaws.com` with `transcribe.amazonaws.com` and remove or modify the encryption context. +The following IAM policy example shows how to grant a ResourceAccessRole permissions for AWS HealthScribe streaming. To use this policy for transcription jobs, remove or modify the encryption context. The `kms:ViaService` condition value is the same for streaming and transcription jobs. @@ -91,3 +90,0 @@ JSON -**** - - @@ -108 +105 @@ JSON - "kms:ViaService": "transcribe.streaming.amazonaws.com", + "kms:ViaService": "transcribe.us-west-2.amazonaws.com", @@ -121 +118 @@ JSON - "kms:ViaService": "transcribe.streaming.amazonaws.com" + "kms:ViaService": "transcribe.us-west-2.amazonaws.com"