AWS workmail documentation change
Summary
Updated user association process documentation with MFA enablement requirements, UI terminology changes ('Associate users' to 'Connect user'), and clarified username matching requirements for automatic association
Security assessment
The changes explicitly add documentation about enabling MFA requirements and security best practices (username consistency for authentication). While this improves security documentation, there is no evidence of addressing a specific existing vulnerability or security incident.
Diff
diff --git a/workmail/latest/adminguide/connecting_wmusers.md b/workmail/latest/adminguide/connecting_wmusers.md index b004e5d54..116d2676b 100644 --- a/workmail/latest/adminguide/connecting_wmusers.md +++ b/workmail/latest/adminguide/connecting_wmusers.md @@ -7 +7 @@ -When a user signs in to the Amazon WorkMail web client with their IAM Identity Center user credentials, the client will open the mailbox of the associated Amazon WorkMail user. If no user in the WorkMail organization is associated with the IAM Identity Center user, WorkMail will create an association between the IAM Identity Center user signing in and the WorkMail user having the same username, if such a WorkMail user exists. Otherwise, the client will display an error message to the user. +To enable MFA to Amazon WorkMail users, you must associate the Amazon WorkMail user with the corresponding IAM Identity Center user. It is recommended to use the same username for a user across Amazon WorkMail and IAM Identity Center. @@ -11 +11 @@ When a user signs in to the Amazon WorkMail web client with their IAM Identity C -You are recommended to use the same username for a user across Amazon WorkMail and IAM Identity Center because WorkMail will create the association automatically when the user first signs in to the Amazon WorkMail web client with their IAM Identity Center user credentials. When the usernames are different, you are responsible to create the association. +Your are recommended to use the same username for a user across Amazon WorkMail and IAM Identity Center because the default user association is based on the username. When the usernames are different, the user association cannot be completed automatically and you are responsible to associate them manually. @@ -13 +13 @@ You are recommended to use the same username for a user across Amazon WorkMail a -###### To associate users, follow these steps. +###### To enable MFA, follow these steps. @@ -23 +23 @@ The **IAM Identity Center Settings** page appears. - 3. Choose **Associate users**. + 3. Choose **Connect user**. @@ -25 +25 @@ The **IAM Identity Center Settings** page appears. - 4. Under **Select a WorkMail user** , select the Amazon WorkMail user you wish to associate. + 4. Under **Select a Amazon WorkMail user** , select the Amazon WorkMail user you want to connect using their username. @@ -27 +27 @@ The **IAM Identity Center Settings** page appears. - 5. Under **Enter the IAM Identity Center user ID** , enter the ID of the IAM Identity Center user you wish to associate. You may copy the ID from the **Assigned users** tab on the **Identity Center** page. + 5. Under **Enter the IAM Identity Center user id** , search for the IAM Identity Center user by the username or user ID.