AWS personalize high security documentation change
Summary
Updated IAM policy guidance to specify passing specific service roles and restrict resource ARNs in permissions
Security assessment
Changed IAM policy resource from wildcard (*) to specific role ARN and emphasized least-privilege access, directly addressing potential over-permission security risks
Diff
diff --git a/personalize/latest/dg/grant-user-permissions.md b/personalize/latest/dg/grant-user-permissions.md index 12288be90..1f2ca566b 100644 --- a/personalize/latest/dg/grant-user-permissions.md +++ b/personalize/latest/dg/grant-user-permissions.md @@ -9 +9 @@ Creating a new IAM policy for your usersProviding access to Amazon Personalize -To provide your users access to Amazon Personalize, you create an IAM policy that grants permission to access your Amazon Personalize resources and pass a role to Amazon Personalize. Then you use that policy when you add permissions to your users, groups or roles. +To provide your users access to Amazon Personalize, you create an IAM policy that grants permission to access your Amazon Personalize resources and pass your service role to Amazon Personalize. Then you use that policy when you add permissions to your users, groups or roles. @@ -13 +13 @@ To provide your users access to Amazon Personalize, you create an IAM policy tha -Create an IAM policy that provides Amazon Personalize full access to your Amazon Personalize resources. +Create an IAM policy that provides Amazon Personalize full access to your Amazon Personalize resources and `PassRole` permissions to pass your service role to Amazon Personalize (created in [Creating an IAM role for Amazon Personalize](./set-up-required-permissions.html#set-up-create-role-with-permissions)). @@ -44 +44 @@ If this is your first time choosing **Policies** , the **Welcome to Managed Poli - "Resource": "*", + "Resource": "arn:aws:iam::123456789012:role/ServiceRoleName", @@ -98,2 +97,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Setting up permissions - @@ -101,0 +100,2 @@ Giving Amazon Personalize permission to access your resources +Giving Amazon Personalize access to Amazon S3 resources +