AWS msk medium security documentation change
Summary
Updated IAM policy example to remove AlterCluster permission, refine topic permissions, and remove group-related permissions
Security assessment
Implements principle of least privilege by removing unnecessary permissions (AlterCluster, group operations) which reduces potential attack surface
Diff
diff --git a/msk/latest/developerguide/create-iam-role.md b/msk/latest/developerguide/create-iam-role.md index c6ae195f6..6403bf4ba 100644 --- a//msk/latest/developerguide/create-iam-role.md +++ b//msk/latest/developerguide/create-iam-role.md @@ -19 +19,7 @@ In this step, you perform two tasks. The first task is to create an IAM policy t -Replace `region` with the code of the AWS Region where you created your cluster. Replace `Account-ID` with your account ID. Replace `msk-serverless-tutorial-cluster` with the name of your serverless cluster. +In the following example, replace the following: + + * `region` with the code of the AWS Region where you created your cluster. + + * `Account-ID` with your AWS account ID. + + * `msk-serverless-tutorial-cluster`/`c07c74ea-5146-4a03-add1-9baa787a5b14-s3` and `msk-serverless-tutorial-cluster` with your serverless cluster ID and topic name. @@ -28 +33,0 @@ Replace `region` with the code of the AWS Region where you created your cluster. - "kafka-cluster:AlterCluster", @@ -38 +43 @@ Replace `region` with the code of the AWS Region where you created your cluster. - "kafka-cluster:*Topic*", + "kafka-cluster:CreateTopic", @@ -40 +45 @@ Replace `region` with the code of the AWS Region where you created your cluster. - "kafka-cluster:ReadData" + "kafka-cluster:DescribeTopic" @@ -45,10 +49,0 @@ Replace `region` with the code of the AWS Region where you created your cluster. - }, - { - "Effect": "Allow", - "Action": [ - "kafka-cluster:AlterGroup", - "kafka-cluster:DescribeGroup" - ], - "Resource": [ - "arn:aws:kafka:region:Account-ID:group/msk-serverless-tutorial-cluster/*" - ]