AWS elasticbeanstalk documentation change
Summary
Replaced inline IAM policy JSON with references to AWS managed policies and restructured documentation
Security assessment
The changes remove detailed IAM policy JSONs and replace them with links to managed policy references. While IAM policies relate to security, there's no evidence this change addresses a specific vulnerability or security incident. The update appears to be documentation restructuring rather than security-related content addition.
Diff
diff --git a/elasticbeanstalk/latest/dg/concepts-roles-service.md index 41d4d01bc..14915f7f9 100644 --- a/elasticbeanstalk/latest/dg/concepts-roles-service.md +++ b/elasticbeanstalk/latest/dg/concepts-roles-service.md @@ -4,0 +5,2 @@ +AWSElasticBeanstalkEnhancedHealthAWSElasticBeanstalkManagedUpdatesCustomerRolePolicy + @@ -11 +13 @@ There are two managed policies that are attached to the service role. These poli -This policy grants all of the permissions that Elastic Beanstalk requires to monitor environment health. It also includes Amazon SQS actions to allow Elastic Beanstalk to monitor queue activity for worker environments. +## `AWSElasticBeanstalkEnhancedHealth` @@ -12,0 +15 @@ This policy grants all of the permissions that Elastic Beanstalk requires to mon +This policy grants permissions for Elastic Beanstalk to monitor instance and environment health. It also includes Amazon SQS actions to allow Elastic Beanstalk to monitor queue activity for worker environments. To view the content of this managed policy, see the [ AWSElasticBeanstalkEnhancedHealth](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSElasticBeanstalkEnhancedHealth.html) page in the _AWS Managed Policy Reference Guide_. @@ -14,29 +17 @@ This policy grants all of the permissions that Elastic Beanstalk requires to mon - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "elasticloadbalancing:DescribeInstanceHealth", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeTargetHealth", - "ec2:DescribeInstances", - "ec2:DescribeInstanceStatus", - "ec2:GetConsoleOutput", - "ec2:AssociateAddress", - "ec2:DescribeAddresses", - "ec2:DescribeSecurityGroups", - "sqs:GetQueueAttributes", - "sqs:GetQueueUrl", - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeScalingActivities", - "autoscaling:DescribeNotificationConfigurations", - "sns:Publish" - ], - "Resource": [ - "*" - ] - } - ] - } +## `AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy` @@ -44 +19 @@ This policy grants all of the permissions that Elastic Beanstalk requires to mon -This policy grants permissions for Elastic Beanstalk to update environments on your behalf to perform managed platform updates. +This policy grants permissions for Elastic Beanstalk to update environments on your behalf to perform managed platform updates. To view the content of this managed policy, see the [AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy.html) page in the _AWS Managed Policy Reference Guide_. @@ -65,288 +39,0 @@ This policy is grouped into statements based on the set of permissions provided. - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "ElasticBeanstalkPermissions", - "Effect": "Allow", - "Action": [ - "elasticbeanstalk:*" - ], - "Resource": "*" - }, - { - "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", - "Effect": "Allow", - "Action": "iam:PassRole", - "Resource": "arn:aws:iam::*:role/*", - "Condition": { - "StringEquals": { - "iam:PassedToService": [ - "elasticbeanstalk.amazonaws.com", - "ec2.amazonaws.com", - "ec2.amazonaws.com.cn", - "autoscaling.amazonaws.com", - "elasticloadbalancing.amazonaws.com", - "ecs.amazonaws.com", - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "ReadOnlyPermissions", - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAccountLimits", - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeLoadBalancers", - "autoscaling:DescribeNotificationConfigurations", - "autoscaling:DescribeScalingActivities", - "autoscaling:DescribeScheduledActions", - "ec2:DescribeAccountAttributes", - "ec2:DescribeAddresses", - "ec2:DescribeAvailabilityZones", - "ec2:DescribeImages", - "ec2:DescribeInstanceAttribute", - "ec2:DescribeInstances", - "ec2:DescribeKeyPairs", - "ec2:DescribeLaunchTemplates", - "ec2:DescribeLaunchTemplateVersions", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSnapshots", - "ec2:DescribeSpotInstanceRequests", - "ec2:DescribeSubnets", - "ec2:DescribeVpcClassicLink", - "ec2:DescribeVpcs", - "elasticloadbalancing:DescribeInstanceHealth", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DescribeTargetHealth", - "logs:DescribeLogGroups", - "rds:DescribeDBEngineVersions", - "rds:DescribeDBInstances", - "rds:DescribeOrderableDBInstanceOptions", - "sns:ListSubscriptionsByTopic" - ], - "Resource": [ - "*" - ] - }, - { - "Sid": "EC2BroadOperationPermissions", - "Effect": "Allow", - "Action": [ - "ec2:AllocateAddress", - "ec2:AssociateAddress", - "ec2:AuthorizeSecurityGroupEgress", - "ec2:AuthorizeSecurityGroupIngress", - "ec2:CreateLaunchTemplate", - "ec2:CreateLaunchTemplateVersion", - "ec2:CreateSecurityGroup", - "ec2:DeleteLaunchTemplate", - "ec2:DeleteLaunchTemplateVersions", - "ec2:DeleteSecurityGroup", - "ec2:DisassociateAddress", - "ec2:ReleaseAddress", - "ec2:RevokeSecurityGroupEgress", - "ec2:RevokeSecurityGroupIngress" - ], - "Resource": "*" - }, - { - "Sid": "EC2RunInstancesOperationPermissions", - "Effect": "Allow", - "Action": "ec2:RunInstances", - "Resource": "*", - "Condition": { - "ArnLike": { - "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" - } - } - }, - { - "Sid": "EC2TerminateInstancesOperationPermissions", - "Effect": "Allow", - "Action": [ - "ec2:TerminateInstances" - ], - "Resource": "arn:aws:ec2:*:*:instance/*", - "Condition": { - "StringLike": { - "ec2:ResourceTag/aws:cloudformation:stack-id": [ - "arn:aws:cloudformation:*:*:stack/awseb-e-*", - "arn:aws:cloudformation:*:*:stack/eb-*" - ] - } - } - }, - { - "Sid": "ECSBroadOperationPermissions", - "Effect": "Allow", - "Action": [ - "ecs:CreateCluster", - "ecs:DescribeClusters", - "ecs:RegisterTaskDefinition" - ], - "Resource": "*" - }, - { - "Sid": "ECSDeleteClusterOperationPermissions", - "Effect": "Allow", - "Action": "ecs:DeleteCluster", - "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" - }, - { - "Sid": "ASGOperationPermissions", - "Effect": "Allow", - "Action": [ - "autoscaling:AttachInstances", - "autoscaling:CreateAutoScalingGroup", - "autoscaling:CreateLaunchConfiguration", - "autoscaling:CreateOrUpdateTags", - "autoscaling:DeleteLaunchConfiguration", - "autoscaling:DeleteAutoScalingGroup", - "autoscaling:DeleteScheduledAction", - "autoscaling:DetachInstances", - "autoscaling:DeletePolicy", - "autoscaling:PutScalingPolicy", - "autoscaling:PutScheduledUpdateGroupAction", - "autoscaling:PutNotificationConfiguration", - "autoscaling:ResumeProcesses",