AWS serverless-application-model medium security documentation change
Summary
Replaced wildcard resource ARNs with specific resource identifiers in IAM policy examples
Security assessment
Policy changes enforce least-privilege principles by narrowing resource scope, directly improving security posture documentation.
Diff
diff --git a/serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md b/serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md index 23080e5f4..9b1388512 100644 --- a/serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md +++ b/serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md @@ -80 +80 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:cloudformation:*:aws:transform/Serverless-2016-10-31" + "arn:aws:cloudformation:region:aws:transform/Serverless-2016-10-31" @@ -99 +99 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:cloudformation:*:111122223333:stack/*" + "arn:aws:cloudformation:region:111122223333:stack/stack-name" @@ -111 +111 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:s3:::*/*" + "arn:aws:s3:::name-of-bucket/key-name" @@ -134 +134 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:ecr:*:111122223333:repository/*" + "arn:aws:ecr:region:111122223333:repository/repository-name" @@ -144 +144 @@ With the modified Hello World application in place, the following policy stateme - "*" + "arn:aws:ecr:region:111122223333:repository/repository-name" @@ -164 +164 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:lambda:*:111122223333:function:*" + "arn:aws:lambda:region:111122223333:function/function-name" @@ -179 +179 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:iam::111122223333:role/*" + "arn:aws:iam::111122223333:role/role-name" @@ -186 +186 @@ With the modified Hello World application in place, the following policy stateme - "Resource": "*", + "Resource": "arn:aws:iam::111122223333:role/role-name", @@ -204 +204 @@ With the modified Hello World application in place, the following policy stateme - "arn:aws:apigateway:*::*" + "arn:aws:apigateway:region:api-id:resource-path"