AWS transcribe: Add customer-managed KMS key permission examples
Summary
Adds a new section and TOC entry documenting the AWS KMS permissions (Encrypt, Decrypt, DescribeKey, GenerateDataKey*) required by both the API caller and the DataAccessRoleArn role when using a customer-managed key, plus an example key policy granting the data access role use of the key.
Security assessment
The new content documents the least-privilege IAM and key-policy permissions needed for customer-managed key encryption, including scoping the key policy to a specific role principal. This is security documentation for encryption/authorization; no specific vulnerability is referenced.
Evidence
+If you use a customer-managed KMS key to encrypt your custom vocabularies, custom vocabulary filters, or custom language models, both the caller making the API request and the IAM role you specify in `DataAccessRoleArn` need access to the key. Both must have the following AWS KMS permissions on the key, and your key policy must grant permissions to both.
Diff
diff --git a/transcribe/latest/dg/security_iam_id-based-policy-examples.md b/transcribe/latest/dg/security_iam_id-based-policy-examples.md index 6e2188a18..9ac47abfb 100644 --- a//transcribe/latest/dg/security_iam_id-based-policy-examples.md +++ b//transcribe/latest/dg/security_iam_id-based-policy-examples.md @@ -7 +7 @@ -Policy best practicesUsing the AWS Management ConsolePermissions required for IAM rolesPermissions required for Amazon S3 encryption keysAllow users to view their own permissionsAWS KMS encryption context policyConfused deputy prevention policyViewing transcription jobs based on tags +Policy best practicesUsing the AWS Management ConsolePermissions required for IAM rolesPermissions required for Amazon S3 encryption keysPermissions required for customer-managed key encryptionAllow users to view their own permissionsAWS KMS encryption context policyConfused deputy prevention policyViewing transcription jobs based on tags @@ -26,0 +27,2 @@ For details about actions and resource types defined by Amazon Transcribe, inclu + * Permissions required for customer-managed key encryption + @@ -235,0 +238,58 @@ JSON +## Permissions required for customer-managed key encryption + +If you use a customer-managed KMS key to encrypt your custom vocabularies, custom vocabulary filters, or custom language models, both the caller making the API request and the IAM role you specify in `DataAccessRoleArn` need access to the key. Both must have the following AWS KMS permissions on the key, and your key policy must grant permissions to both. For more information about encrypting resource artifacts with a customer-managed key, see [Encrypting resource artifacts with a customer-managed key](./data-encryption.html#kms-resource-encryption). + +JSON + + +**** + + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "kms:Encrypt", + "kms:Decrypt", + "kms:DescribeKey", + "kms:GenerateDataKey*" + ], + "Resource": "arn:aws:kms:us-west-2:111122223333:key/KMS-Example-KeyId" + } + ] + } + + +You must also add a key policy to your customer-managed key that grants the data access role permission to use the key. The following is an example key policy. + +JSON + + +**** + + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "Allow use of the key", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::111122223333:role/ExampleDataAccessRole" + }, + "Action": [ + "kms:Encrypt", + "kms:Decrypt", + "kms:GenerateDataKey*", + "kms:DescribeKey" + ], + "Resource": "*" + } + ] + } + +