AWS eventbridge: Retitle KMS key policy link in custom bus permissions table
Summary
Updates the encryption row's cross-reference link text from 'Writing the key policy' to 'Configuring permissions to use a Customer Managed KMS Key'; the underlying permissions (kms:DescribeKey, kms:Decrypt/Encrypt, GenerateDataKeyWithoutPlaintext, ReEncryptFrom/To scoped via aws:events:event-busv2:arn) are unchanged.
Security assessment
Only the hyperlink label changed; the KMS permission guidance itself is identical, so this is a cosmetic edit to encryption-related documentation rather than a new control or fix.
Evidence
+Encrypt a bus with your own key| The key policy| The bus creator's identity needs `kms:DescribeKey`; that identity, every producer and subscriber owner, and the `events.amazonaws.com` principal need `kms:Decrypt`, `kms:Encrypt`, `kms:GenerateDataKeyWithoutPlaintext`, `kms:ReEncryptFrom`, and `kms:ReEncryptTo`, scoped to the bus with the `aws:events:event-busv2:arn` encryption context. See [Configuring permissions to use a Customer Managed KMS Key](./eb-custom-bus-encryption.html#eb-custom-bus-encryption-key-policy)
Diff
diff --git a/eventbridge/latest/userguide/eb-custom-bus-permissions.md b/eventbridge/latest/userguide/eb-custom-bus-permissions.md index 9f59d9d22..88fb58349 100644 --- a//eventbridge/latest/userguide/eb-custom-bus-permissions.md +++ b//eventbridge/latest/userguide/eb-custom-bus-permissions.md @@ -20 +20 @@ Administer a bus| The bus owner's identity| `events:CreateEventBus`, `events:Upd -Encrypt a bus with your own key| The key policy| The bus creator's identity needs `kms:DescribeKey`; that identity, every producer and subscriber owner, and the `events.amazonaws.com` principal need `kms:Decrypt`, `kms:Encrypt`, `kms:GenerateDataKeyWithoutPlaintext`, `kms:ReEncryptFrom`, and `kms:ReEncryptTo`, scoped to the bus with the `aws:events:event-busv2:arn` encryption context. See [Writing the key policy](./eb-custom-bus-encryption.html#eb-custom-bus-encryption-key-policy) +Encrypt a bus with your own key| The key policy| The bus creator's identity needs `kms:DescribeKey`; that identity, every producer and subscriber owner, and the `events.amazonaws.com` principal need `kms:Decrypt`, `kms:Encrypt`, `kms:GenerateDataKeyWithoutPlaintext`, `kms:ReEncryptFrom`, and `kms:ReEncryptTo`, scoped to the bus with the `aws:events:event-busv2:arn` encryption context. See [Configuring permissions to use a Customer Managed KMS Key](./eb-custom-bus-encryption.html#eb-custom-bus-encryption-key-policy)