AWS elasticbeanstalk documentation change
Summary
Restructured managed policy documentation, replaced inline JSON policies with references to AWS Managed Policy Guide, and added SQS permissions for worker environment monitoring
Security assessment
The changes improve documentation about IAM security features (managed policies) and add clarification about required SQS permissions. While these relate to security controls, there is no evidence in the diff indicating they address a specific security vulnerability or incident. The changes appear to be documentation improvements rather than security fixes.
Diff
diff --git a/elasticbeanstalk/latest/dg/iam-servicerole.md index af59ac1ed..f2de9bf8a 100644 --- a/elasticbeanstalk/latest/dg/iam-servicerole.md +++ b/elasticbeanstalk/latest/dg/iam-servicerole.md @@ -25 +25 @@ Elastic Beanstalk provides one managed policy for [enhanced health monitoring](. -This policy grants permissions for Elastic Beanstalk to monitor instance and environment health. +#### `AWSElasticBeanstalkEnhancedHealth` @@ -26,0 +27 @@ This policy grants permissions for Elastic Beanstalk to monitor instance and env +This policy grants permissions for Elastic Beanstalk to monitor instance and environment health. It also includes Amazon SQS actions to allow Elastic Beanstalk to monitor queue activity for worker environments. To view the content of this managed policy, see the [ AWSElasticBeanstalkEnhancedHealth](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSElasticBeanstalkEnhancedHealth.html) page in the _AWS Managed Policy Reference Guide_. @@ -28,29 +29 @@ This policy grants permissions for Elastic Beanstalk to monitor instance and env - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "elasticloadbalancing:DescribeInstanceHealth", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeTargetHealth", - "ec2:DescribeInstances", - "ec2:DescribeInstanceStatus", - "ec2:GetConsoleOutput", - "ec2:AssociateAddress", - "ec2:DescribeAddresses", - "ec2:DescribeSecurityGroups", - "sqs:GetQueueAttributes", - "sqs:GetQueueUrl", - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeScalingActivities", - "autoscaling:DescribeNotificationConfigurations", - "sns:Publish" - ], - "Resource": [ - "*" - ] - } - ] - } +#### `AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy` @@ -58 +31 @@ This policy grants permissions for Elastic Beanstalk to monitor instance and env -This policy grants permissions for Elastic Beanstalk to update environments on your behalf to perform managed platform updates. +This policy grants permissions for Elastic Beanstalk to update environments on your behalf to perform managed platform updates. To view the content of this managed policy, see the [AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy.html) page in the _AWS Managed Policy Reference Guide_. @@ -79,288 +51,0 @@ This policy is grouped into statements based on the set of permissions provided. - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "ElasticBeanstalkPermissions", - "Effect": "Allow", - "Action": [ - "elasticbeanstalk:*" - ], - "Resource": "*" - }, - { - "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", - "Effect": "Allow", - "Action": "iam:PassRole", - "Resource": "arn:aws:iam::*:role/*", - "Condition": { - "StringEquals": { - "iam:PassedToService": [ - "elasticbeanstalk.amazonaws.com", - "ec2.amazonaws.com", - "ec2.amazonaws.com.cn", - "autoscaling.amazonaws.com", - "elasticloadbalancing.amazonaws.com", - "ecs.amazonaws.com", - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "ReadOnlyPermissions", - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAccountLimits", - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeLoadBalancers", - "autoscaling:DescribeNotificationConfigurations", - "autoscaling:DescribeScalingActivities", - "autoscaling:DescribeScheduledActions", - "ec2:DescribeAccountAttributes", - "ec2:DescribeAddresses", - "ec2:DescribeAvailabilityZones", - "ec2:DescribeImages", - "ec2:DescribeInstanceAttribute", - "ec2:DescribeInstances", - "ec2:DescribeKeyPairs", - "ec2:DescribeLaunchTemplates", - "ec2:DescribeLaunchTemplateVersions", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSnapshots", - "ec2:DescribeSpotInstanceRequests", - "ec2:DescribeSubnets", - "ec2:DescribeVpcClassicLink", - "ec2:DescribeVpcs", - "elasticloadbalancing:DescribeInstanceHealth", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DescribeTargetHealth", - "logs:DescribeLogGroups", - "rds:DescribeDBEngineVersions", - "rds:DescribeDBInstances", - "rds:DescribeOrderableDBInstanceOptions", - "sns:ListSubscriptionsByTopic" - ], - "Resource": [ - "*" - ] - }, - { - "Sid": "EC2BroadOperationPermissions", - "Effect": "Allow", - "Action": [ - "ec2:AllocateAddress", - "ec2:AssociateAddress", - "ec2:AuthorizeSecurityGroupEgress", - "ec2:AuthorizeSecurityGroupIngress", - "ec2:CreateLaunchTemplate", - "ec2:CreateLaunchTemplateVersion", - "ec2:CreateSecurityGroup", - "ec2:DeleteLaunchTemplate", - "ec2:DeleteLaunchTemplateVersions", - "ec2:DeleteSecurityGroup", - "ec2:DisassociateAddress", - "ec2:ReleaseAddress", - "ec2:RevokeSecurityGroupEgress", - "ec2:RevokeSecurityGroupIngress" - ], - "Resource": "*" - }, - { - "Sid": "EC2RunInstancesOperationPermissions", - "Effect": "Allow", - "Action": "ec2:RunInstances", - "Resource": "*", - "Condition": { - "ArnLike": { - "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" - } - } - }, - { - "Sid": "EC2TerminateInstancesOperationPermissions", - "Effect": "Allow", - "Action": [ - "ec2:TerminateInstances" - ], - "Resource": "arn:aws:ec2:*:*:instance/*", - "Condition": { - "StringLike": { - "ec2:ResourceTag/aws:cloudformation:stack-id": [ - "arn:aws:cloudformation:*:*:stack/awseb-e-*", - "arn:aws:cloudformation:*:*:stack/eb-*" - ] - } - } - }, - { - "Sid": "ECSBroadOperationPermissions", - "Effect": "Allow", - "Action": [ - "ecs:CreateCluster", - "ecs:DescribeClusters", - "ecs:RegisterTaskDefinition" - ], - "Resource": "*" - }, - { - "Sid": "ECSDeleteClusterOperationPermissions", - "Effect": "Allow", - "Action": "ecs:DeleteCluster", - "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" - }, - { - "Sid": "ASGOperationPermissions", - "Effect": "Allow", - "Action": [ - "autoscaling:AttachInstances", - "autoscaling:CreateAutoScalingGroup", - "autoscaling:CreateLaunchConfiguration", - "autoscaling:CreateOrUpdateTags", - "autoscaling:DeleteLaunchConfiguration", - "autoscaling:DeleteAutoScalingGroup", - "autoscaling:DeleteScheduledAction", - "autoscaling:DetachInstances", - "autoscaling:DeletePolicy", - "autoscaling:PutScalingPolicy", - "autoscaling:PutScheduledUpdateGroupAction", - "autoscaling:PutNotificationConfiguration", - "autoscaling:ResumeProcesses", - "autoscaling:SetDesiredCapacity", - "autoscaling:SuspendProcesses", - "autoscaling:TerminateInstanceInAutoScalingGroup",