AWS autoscaling documentation change
Summary
Updated ElastiCache service-linked role policy to support Memcached, Redis OSS, and Valkey scaling. Added ModifyCacheCluster permission, adjusted CloudWatch DescribeAlarms resource scope, and removed DeleteAlarms permission. Documented policy changes in changelog.
Security assessment
Changes involve IAM policy updates for service roles, which are security-related documentation. However, there is no evidence these changes address a specific security vulnerability. The modifications enable new scaling functionality rather than patching a security issue.
Diff
diff --git a/autoscaling/application/userguide/security-iam-awsmanpol.md b/autoscaling/application/userguide/security-iam-awsmanpol.md index a8274634f..da894aae4 100644 --- a//autoscaling/application/userguide/security-iam-awsmanpol.md +++ b//autoscaling/application/userguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AWSApplicationAutoscalingAppStreamFleetPolicyAWSApplicationAutoscalingRDSClusterPolicyAWSApplicationAutoscalingComprehendEndpointPolicyAWSApplicationAutoscalingDynamoDBTablePolicyAWSApplicationAutoscalingECSServicePolicyAWSApplicationAutoscalingElastiCacheRGPolicyAWSApplicationAutoscalingCassandraTablePolicyAWSApplicationAutoscalingLambdaConcurrencyPolicyAWSApplicationAutoscalingKafkaClusterPolicyAWSApplicationAutoscalingNeptuneClusterPolicyAWSApplicationAutoscalingSageMakerEndpointPolicyAWSApplicationAutoscalingEC2SpotFleetRequestPolicyAWSApplicationAutoscalingWorkSpacesPoolPolicyAWSApplicationAutoScalingCustomResourcePolicyApplication Auto Scaling updates to AWS managed policies +AWSApplicationAutoscalingAppStreamFleetPolicyAWSApplicationAutoscalingRDSClusterPolicyAWSApplicationAutoscalingComprehendEndpointPolicyAWSApplicationAutoscalingDynamoDBTablePolicyAWSApplicationAutoscalingECSServicePolicyAWSApplicationAutoscalingElastiCacheRGPolicyAWSApplicationAutoscalingCassandraTablePolicyAWSApplicationAutoscalingLambdaConcurrencyPolicyAWSApplicationAutoscalingKafkaClusterPolicyAWSApplicationAutoscalingNeptuneClusterPolicyAWSApplicationAutoscalingSageMakerEndpointPolicyAWSApplicationAutoscalingEC2SpotFleetRequestPolicyAWSApplicationAutoscalingWorkSpacesPoolPolicyAWSApplicationAutoScalingCustomResourcePolicyPolicy updates @@ -144 +144 @@ The permissions policy allows Application Auto Scaling to complete the following -This policy is attached to the service-linked role named [AWSServiceRoleForApplicationAutoScaling_ElastiCacheRG](./application-auto-scaling-service-linked-roles.html) to allow Application Auto Scaling to call ElastiCache and CloudWatch and perform scaling on your behalf. +This policy is attached to the service-linked role named [AWSServiceRoleForApplicationAutoScaling_ElastiCacheRG](./application-auto-scaling-service-linked-roles.html) to allow Application Auto Scaling to call ElastiCache and CloudWatch and perform scaling on your behalf. This service-linked role can be used for ElastiCache Memcached, Redis OSS, and Valkey. @@ -162 +162,3 @@ The permissions policy allows Application Auto Scaling to complete the following - * Action: `cloudwatch:DescribeAlarms` on all resources + * Action: `elasticache:ModifyCacheCluster` on all resources + + * Action: `cloudwatch:DescribeAlarms` on the resource `arn:aws:cloudwatch:*:*:alarm:*` @@ -168,2 +169,0 @@ The permissions policy allows Application Auto Scaling to complete the following - * Action: `cloudwatch:DeleteAlarms` - @@ -389 +389,2 @@ Change | Description | Date -AWSApplicationAutoscalingECSServicePolicy – Update an existing policy | Added permission to call CloudWatch `GetMetricData` API action to support predictive scaling. | November 21, 2024 +AWSApplicationAutoscalingElastiCacheRGPolicy – Update an existing policy | Added permission to call the ElastiCache `ModifyCacheCluster` API action to support Memcached automatic scaling. | April 10, 2025 +AWSApplicationAutoscalingECSServicePolicy – Update an existing policy | Added permission to call the CloudWatch `GetMetricData` API action to support predictive scaling. | November 21, 2024