AWS directoryservice documentation change
Summary
Added AWS administrative control details, security recommendations, and restructured permissions documentation
Security assessment
Enhanced documentation about AWS's administrative access and security best practices, but no indication of addressing a specific security incident
Diff
diff --git a/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.md b/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.md index 099504b89..8efe1080e 100644 --- a/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.md +++ b/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.md @@ -7 +7 @@ Enterprise and domain administrator privileged accounts -# AWS Managed Microsoft AD Administrator account permissions +# AWS Managed Microsoft AD Administrator account and group permissions @@ -45 +45,7 @@ Only the actions listed here are allowed for the Admin account. The Admin accoun -###### Important +###### Considerations + + * AWS Domain Administrators have full administrative access to all domains hosted on AWS. See your agreement with AWS and the [AWS data protection FAQ](https://aws.amazon.com/compliance/data-privacy-faq/) for more information about how AWS handles content, including directory information, that you store on AWS systems. + + * We recommend that you do not delete or rename this account. If you no longer want to use the account, we recommend you set a long password (at most 64 random characters) and then disable the account. + + @@ -47 +52,0 @@ Only the actions listed here are allowed for the Admin account. The Admin accoun -AWS Domain Administrators have full administrative access to all domains hosted on AWS. See your agreement with AWS and the [AWS data protection FAQ](https://aws.amazon.com/compliance/data-privacy-faq/) for more information about how AWS handles content, including directory information, that you store on AWS systems. @@ -51 +56 @@ AWS Domain Administrators have full administrative access to all domains hosted -We recommend that you do not delete or rename this account. If you no longer want to use the account, we recommend you set a long password (at most 64 random characters) and then disable the account. +AWS has exclusive control of accounts with Domain Administrator and Enterprise Administrator privileged groups. This allows AWS to perform operational management of your directory.