AWS eventbridge: Rename encryption doc link text in custom bus create page
Summary
Updated two cross-reference labels to the custom event bus encryption page (in the --encryption-configuration CLI parameter table and the failed-state/troubleshooting section) to 'Encryption at Rest for Amazon EventBridge Custom Event Bus'. The KMS key guidance and key-policy warnings are untouched.
Security assessment
Both diff hunks only change the visible link text of an existing KMS encryption reference; the customer managed key identifier semantics and the warning about not removing key access mid-update are unchanged, so no security content is added or modified.
Evidence
+`--encryption-configuration` | `KmsKeyIdentifier`: a key ID, key ARN, alias name, or alias ARN of a AWS KMS customer managed key. Omit it and EventBridge encrypts events with an AWS owned key. For the key policy the key needs, see [Encryption at Rest for Amazon EventBridge Custom Event Bus](./eb-custom-bus-encryption.html).
Diff
diff --git a/eventbridge/latest/userguide/eb-custom-bus-create.md b/eventbridge/latest/userguide/eb-custom-bus-create.md index b8ed83bbd..dc3d153e0 100644 --- a//eventbridge/latest/userguide/eb-custom-bus-create.md +++ b//eventbridge/latest/userguide/eb-custom-bus-create.md @@ -32 +32 @@ Parameter | What it accepts -`--encryption-configuration` | `KmsKeyIdentifier`: a key ID, key ARN, alias name, or alias ARN of a AWS KMS customer managed key. Omit it and EventBridge encrypts events with an AWS owned key. For the key policy the key needs, see [Encrypting events on a Custom Event Bus](./eb-custom-bus-encryption.html). +`--encryption-configuration` | `KmsKeyIdentifier`: a key ID, key ARN, alias name, or alias ARN of a AWS KMS customer managed key. Omit it and EventBridge encrypts events with an AWS owned key. For the key policy the key needs, see [Encryption at Rest for Amazon EventBridge Custom Event Bus](./eb-custom-bus-encryption.html). @@ -92 +92 @@ State | How the bus gets there | What you can do -Both failed states that a running bus can reach come from the AWS KMS key. When an update to a new key fails, retry `UpdateEventBus` after you fix the key's policy or grant. If the new key itself is unusable, the retry can name a different key, because EventBridge did not adopt the failed key. Do not disable, delete, or remove EventBridge's access to the previous key until `DescribeEventBus` shows the bus `ACTIVE` with the new key; a bus that loses its old key part-way through a change can only be repaired by restoring that key, or deleted. For the key permissions, see [Encrypting events on a Custom Event Bus](./eb-custom-bus-encryption.html). +Both failed states that a running bus can reach come from the AWS KMS key. When an update to a new key fails, retry `UpdateEventBus` after you fix the key's policy or grant. If the new key itself is unusable, the retry can name a different key, because EventBridge did not adopt the failed key. Do not disable, delete, or remove EventBridge's access to the previous key until `DescribeEventBus` shows the bus `ACTIVE` with the new key; a bus that loses its old key part-way through a change can only be repaired by restoring that key, or deleted. For the key permissions, see [Encryption at Rest for Amazon EventBridge Custom Event Bus](./eb-custom-bus-encryption.html).