AWS datazone: Fix KMS key ARN and ViaService examples to us-east-1
Summary
Replaces the generic 'region' placeholder with 'us-east-1' in the KMS key ARN Resource fields and in the kms:ViaService condition key within the DataZone encryption-at-rest policy statement examples.
Security assessment
The change corrects example KMS key policy statements used to grant DataZone access to customer-managed keys, making the ARN and kms:ViaService condition concrete and copy-pasteable; it improves the accuracy of encryption/key-policy guidance but does not remediate a specific vulnerability.
Evidence
+ "kms:ViaService": "datazone.us-east-1.amazonaws.com"
Diff
diff --git a/datazone/latest/userguide/encryption-rest-datazone.md b/datazone/latest/userguide/encryption-rest-datazone.md index f11e724..3259885 100644 --- a//datazone/latest/userguide/encryption-rest-datazone.md +++ b//datazone/latest/userguide/encryption-rest-datazone.md @@ -104 +104 @@ The following are policy statement examples you can add for Amazon DataZone: - "Resource": "arn:aws:kms:region:111122223333:key/key_ID" + "Resource": "arn:aws:kms:us-east-1:111122223333:key/key_ID" @@ -116 +116 @@ The following are policy statement examples you can add for Amazon DataZone: - "Resource": "arn:aws:kms:region:111122223333:key/key_ID", + "Resource": "arn:aws:kms:us-east-1:111122223333:key/key_ID", @@ -130 +130 @@ The following are policy statement examples you can add for Amazon DataZone: - "Resource": "arn:aws:kms:region:111122223333:key/key_ID", + "Resource": "arn:aws:kms:us-east-1:111122223333:key/key_ID", @@ -134 +134 @@ The following are policy statement examples you can add for Amazon DataZone: - "kms:ViaService": "datazone.region.amazonaws.com" + "kms:ViaService": "datazone.us-east-1.amazonaws.com"