AWS emr: Fix KMS key ARN placeholder and remove Sid in EMR encryption policy
Summary
Replaces the 'key-arn' placeholder with a concrete KMS key ARN and removes the 'Enable GDK and Decrypt' Sid in the disk encryption IAM policy examples.
Security assessment
Improves the accuracy of KMS-based disk encryption policy examples by using a valid key ARN format; it is documentation of encryption configuration, not a fix for a specific vulnerability.
Evidence
+ "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/disk-encryption-cmk.md b/emr/latest/EMR-Serverless-UserGuide/disk-encryption-cmk.md index bc2888d..d3fc805 100644 --- a//emr/latest/EMR-Serverless-UserGuide/disk-encryption-cmk.md +++ b//emr/latest/EMR-Serverless-UserGuide/disk-encryption-cmk.md @@ -140 +139,0 @@ The job runtime role must have the following permissions in its IAM policy: - "Sid": "Enable GDK and Decrypt", @@ -148 +147 @@ The job runtime role must have the following permissions in its IAM policy: - "Resource": "key-arn" + "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" @@ -212 +211 @@ The following IAM policy provides the permissions to `kms:DescribeKey`, `kms:Gen - "Resource": "key-arn" + "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"