AWS artifact documentation change
Summary
Added AWS GovCloud (US) specific policy examples and ARN mappings, updated deprecation timeline for DownloadAgreement action, and removed region availability note
Security assessment
The changes primarily add documentation for GovCloud region support and migrate permissions to fine-grained access. While IAM policy examples are security-related documentation, there's no evidence these changes address a specific security vulnerability or incident.
Diff
diff --git a/artifact/latest/ug/migrating-agreements-to-v2-permissions.md b/artifact/latest/ug/migrating-agreements-to-v2-permissions.md index b9aa88b6d..c1753865c 100644 --- a//artifact/latest/ug/migrating-agreements-to-v2-permissions.md +++ b//artifact/latest/ug/migrating-agreements-to-v2-permissions.md @@ -9,4 +8,0 @@ Migrating to new permissions LegacyToFineGrainedMapping -###### Note - -The content of this page is only applicable to commercial AWS [Regions](https://docs.aws.amazon.com/glossary/latest/reference/glos-chap.html?icmpid=docs_homepage_addtlrcs#region), and does not currently apply to AWS GovCloud (US) Regions. - @@ -19 +15 @@ To access agreements through the fine-grained permissions, you can utilize the [ -The legacy IAM action `artifact:DownloadAgreement` is deprecated as of March 3, 2025. +The IAM action `artifact:DownloadAgreement` will be deprecated in the AWS GovCloud (US) partition on July 1, 2025. The same action was deprecated in the AWS partition on March 3, 2025. @@ -28,0 +25,3 @@ Legacy Policy: +AWS + + @@ -45,0 +45,22 @@ Legacy Policy: + +AWS GovCloud (US) + + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "artifact:DownloadAgreement" + ], + "Resource": [ + "arn:aws-us-gov:artifact::*:customer-agreement/*", + "arn:aws-us-gov:artifact:::agreement/*" + ] + } + ] + } + + @@ -47,0 +69,3 @@ New Policy with fine-grained permissions: +AWS + + @@ -77,0 +102,35 @@ New Policy with fine-grained permissions: + +AWS GovCloud (US) + + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "ListAgreementsActions", + "Effect": "Allow", + "Action": [ + "artifact:ListAgreements", + "artifact:ListCustomerAgreements" + ], + "Resource": "*" + }, + { + "Sid": "GetAgreementActions", + "Effect": "Allow", + "Action": [ + "artifact:GetCustomerAgreement", + "artifact:GetAgreement", + "artifact:GetNdaForAgreement", + "artifact:AcceptNdaForAgreement" + ], + "Resource": [ + "arn:aws-us-gov:artifact::*:customer-agreement/*", + "arn:aws-us-gov:artifact:::agreement/*" + ] + } + ] + } + + @@ -81,0 +141,3 @@ Legacy Policy: +AWS + + @@ -100,0 +163,24 @@ Legacy Policy: + +AWS GovCloud (US) + + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "artifact:AcceptAgreement", + "artifact:DownloadAgreement", + "artifact:TerminateAgreement" + ], + "Resource": [ + "arn:aws-us-gov:artifact::*:customer-agreement/*", + "arn:aws-us-gov:artifact:::agreement/*" + ] + } + ] + } + + @@ -102,0 +189,3 @@ New Policy with fine-grained permissions: +AWS + + @@ -138,0 +228,41 @@ New Policy with fine-grained permissions: + +AWS GovCloud (US) + + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "ListAgreementActions", + "Effect": "Allow", + "Action": [ + "artifact:ListAgreements", + "artifact:ListCustomerAgreements" + ], + "Resource": "*" + }, + { + "Sid": "AWSAgreementActions", + "Effect": "Allow", + "Action": [ + "artifact:GetAgreement", + "artifact:AcceptNdaForAgreement", + "artifact:GetNdaForAgreement", + "artifact:AcceptAgreement" + ], + "Resource": "arn:aws-us-gov:artifact:::agreement/*" + }, + { + "Sid": "CustomerAgreementActions", + "Effect": "Allow", + "Action": [ + "artifact:GetCustomerAgreement", + "artifact:TerminateAgreement" + ], + "Resource": "arn:aws-us-gov:artifact::*:customer-agreement/*" + } + ] + } + + @@ -142,0 +273,3 @@ Legacy Policy: +AWS + + @@ -181,0 +315,44 @@ Legacy Policy: + +AWS GovCloud (US) + + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "artifact:AcceptAgreement", + "artifact:DownloadAgreement", + "artifact:TerminateAgreement" + ], + "Resource": [ + "arn:aws-us-gov:artifact::*:customer-agreement/*", + "arn:aws-us-gov:artifact:::agreement/*" + ] + }, + { + "Effect": "Allow", + "Action": "iam:ListRoles", + "Resource": "arn:aws-us-gov:iam:::role/*" + }, + { + "Effect": "Allow", + "Action": "iam:CreateServiceLinkedRole", + "Resource": "arn:aws-us-gov:iam:::role/aws-service-role/artifact.amazonaws.com/AWSServiceRoleForArtifact" + }, + { + "Effect": "Allow", + "Action": [ + "organizations:DescribeOrganization", + "organizations:EnableAWSServiceAccess", + "organizations:ListAccounts", + "organizations:ListAWSServiceAccessForOrganization" + ], + "Resource": "*" + } + ]