AWS AmazonCloudWatch medium security documentation change
Summary
Added optional resource-based policy configuration for controlling PutRumEvents access and renumbered subsequent steps
Security assessment
Introduces resource-based policy controls for PutRumEvents access, which directly relates to security authorization mechanisms. The explicit mention of controlling who can send events and bypassing AWS credential requirements constitutes security-related configuration.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-get-started-create-app-monitor.md index 73e6d77f5..8f0700dbf 100644 --- a/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-get-started-create-app-monitor.md +++ b/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-get-started-create-app-monitor.md @@ -43 +43,3 @@ If you don't select any of these, the app monitor still collects session start e - 9. For **Authorization** , specify whether to use a new or existing Amazon Cognito identity pool or use a different identity provider. Creating a new identity pool is the simplest option that requires no other setup steps. For more information, see see [Step 1: Authorize your application to send data to AWS](./CloudWatch-RUM-get-started-authorization.html). + 9. (Optional) Choose to add a resource-based policy to your app monitor to control who can send `PutRumEvents` requests to your app monitor. If you choose **Create public policy** , a resource policy will be attached to your app monitor that enables anyone to send `PutRumEvents` requests to your app monitor. For more information about this method, see [Using resource-based policies with CloudWatch RUM](./CloudWatch-RUM-resource-policies.html). + + 10. If you attached a resource-based policy in step 9, then you don't need to sign requests to CloudWatch RUM with AWS credentials, and you can skip setting up authorization. Otherwise, for **Authorization** , specify whether to use a new or existing Amazon Cognito identity pool or use a different identity provider. Creating a new identity pool is the simplest option that requires no other setup steps. For more information, see see [Step 1: Authorize your application to send data to AWS](./CloudWatch-RUM-get-started-authorization.html). @@ -47 +49 @@ Creating a new Amazon Cognito identity pool requires administrative permissions. - 10. (Optional) By default, when you add the RUM code snippet to your application, the web client injects the JavaScript tag to monitor usage into the HTML code of all pages of your application. To change this, choose **Configure pages** and then choose either **Include only these pages** or **Exclude these pages**. Then, specify the pages to include or exclude. To specify a page to include or exclude, enter its complete URLs. To specify additional pages, choose **Add URL**. + 11. (Optional) By default, when you add the RUM code snippet to your application, the web client injects the JavaScript tag to monitor usage into the HTML code of all pages of your application. To change this, choose **Configure pages** and then choose either **Include only these pages** or **Exclude these pages**. Then, specify the pages to include or exclude. To specify a page to include or exclude, enter its complete URLs. To specify additional pages, choose **Add URL**. @@ -49 +51 @@ Creating a new Amazon Cognito identity pool requires administrative permissions. - 11. To enable AWS X-Ray tracing of the user sessions that are sampled by the app monitor, choose **Active tracing** and select **Trace my service with AWS X-Ray.** + 12. To enable AWS X-Ray tracing of the user sessions that are sampled by the app monitor, choose **Active tracing** and select **Trace my service with AWS X-Ray.** @@ -55 +57 @@ By making additional configuration changes to the CloudWatch RUM web client, you - 12. (Optional) To add tags to the app monitor, choose **Tags** , **Add new tag**. + 13. (Optional) To add tags to the app monitor, choose **Tags** , **Add new tag**. @@ -63 +65 @@ For more information, see [Tagging AWS Resources](https://docs.aws.amazon.com/ge - 13. Choose **Add app monitor**. + 14. Choose **Add app monitor**. @@ -65 +67 @@ For more information, see [Tagging AWS Resources](https://docs.aws.amazon.com/ge - 14. In the **Sample code** section, you can copy the code snippet to use to add to your application. We recommend that you choose **JavaScript** or **TypeScript** and use NPM to install the CloudWatch RUM web client as a JavaScript module. + 15. In the **Sample code** section, you can copy the code snippet to use to add to your application. We recommend that you choose **JavaScript** or **TypeScript** and use NPM to install the CloudWatch RUM web client as a JavaScript module. @@ -69 +71 @@ Alternatively, you can choose **HTML** to use a content delivery network (CDN) t - 15. Choose **Copy** or **Download** , and then choose **Done**. + 16. Choose **Copy** or **Download** , and then choose **Done**.