AWS drs documentation change
Summary
Replaced inline IAM policy JSON with a reference link to AWS Managed Policy Guide
Security assessment
Change removes detailed policy documentation in favor of external reference, but doesn't indicate any security vulnerability fix or new security feature. Policy documentation maintenance rather than security update.
Diff
diff --git a/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryLaunchActionsPolicy.md b/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryLaunchActionsPolicy.md index 33c8ea54e..91cfe1959 100644 --- a//drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryLaunchActionsPolicy.md +++ b//drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryLaunchActionsPolicy.md @@ -13,261 +13 @@ This policy allows you to use Amazon SSM and additional services required permis -This policy includes the following permissions. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "LaunchActionsPolicy1", - "Effect": "Allow", - "Action": [ - "ssm:DescribeInstanceInformation", - "ssm:DescribeParameters" - - ], - "Resource": [ - "*" - ], - "Condition": { - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "drs.amazonaws.com" - ] - } - } - }, - { - "Sid": "LaunchActionsPolicy2", - "Effect": "Allow", - "Action": [ - "ssm:SendCommand", - "ssm:StartAutomationExecution" - ], - "Resource": [ - "arn:aws:ssm:*:*:document/*", - "arn:aws:ssm:*:*:automation-definition/*:*" - ], - "Condition": { - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "drs.amazonaws.com" - ] - }, - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "LaunchActionsPolicy3", - "Effect": "Allow", - "Action": [ - "ssm:SendCommand", - "ssm:StartAutomationExecution" - ], - "Resource": [ - "arn:aws:ssm:*::document/AWS-*", - "arn:aws:ssm:*::document/AWSCodeDeployAgent-*", - "arn:aws:ssm:*::document/AWSConfigRemediation-*", - "arn:aws:ssm:*::document/AWSConformancePacks-*", - "arn:aws:ssm:*::document/AWSDisasterRecovery-*", - "arn:aws:ssm:*::document/AWSDistroOTel-*", - "arn:aws:ssm:*::document/AWSDocs-*", - "arn:aws:ssm:*::document/AWSEC2-*", - "arn:aws:ssm:*::document/AWSEC2Launch-*", - "arn:aws:ssm:*::document/AWSFIS-*", - "arn:aws:ssm:*::document/AWSFleetManager-*", - "arn:aws:ssm:*::document/AWSIncidents-*", - "arn:aws:ssm:*::document/AWSKinesisTap-*", - "arn:aws:ssm:*::document/AWSMigration-*", - "arn:aws:ssm:*::document/AWSNVMe-*", - "arn:aws:ssm:*::document/AWSNitroEnclavesWindows-*", - "arn:aws:ssm:*::document/AWSObservabilityExporter-*", - "arn:aws:ssm:*::document/AWSPVDriver-*", - "arn:aws:ssm:*::document/AWSQuickSetupType-*", - "arn:aws:ssm:*::document/AWSQuickStarts-*", - "arn:aws:ssm:*::document/AWSRefactorSpaces-*", - "arn:aws:ssm:*::document/AWSResilienceHub-*", - "arn:aws:ssm:*::document/AWSSAP-*", - "arn:aws:ssm:*::document/AWSSAPTools-*", - "arn:aws:ssm:*::document/AWSSQLServer-*", - "arn:aws:ssm:*::document/AWSSSO-*", - "arn:aws:ssm:*::document/AWSSupport-*", - "arn:aws:ssm:*::document/AWSSystemsManagerSAP-*", - "arn:aws:ssm:*::document/AmazonCloudWatch-*", - "arn:aws:ssm:*::document/AmazonCloudWatchAgent-*", - "arn:aws:ssm:*::document/AmazonECS-*", - "arn:aws:ssm:*::document/AmazonEFSUtils-*", - "arn:aws:ssm:*::document/AmazonEKS-*", - "arn:aws:ssm:*::document/AmazonInspector-*", - "arn:aws:ssm:*::document/AmazonInspector2-*", - "arn:aws:ssm:*::document/AmazonInternal-*", - "arn:aws:ssm:*::document/AwsEnaNetworkDriver-*", - "arn:aws:ssm:*::document/AwsVssComponents-*", - "arn:aws:ssm:*::automation-definition/AWS-*:*", - "arn:aws:ssm:*::automation-definition/AWSCodeDeployAgent-*:*", - "arn:aws:ssm:*::automation-definition/AWSConfigRemediation-*:*", - "arn:aws:ssm:*::automation-definition/AWSConformancePacks-*:*", - "arn:aws:ssm:*::automation-definition/AWSDisasterRecovery-*:*", - "arn:aws:ssm:*::automation-definition/AWSDistroOTel-*:*", - "arn:aws:ssm:*::automation-definition/AWSDocs-*:*", - "arn:aws:ssm:*::automation-definition/AWSEC2-*:*", - "arn:aws:ssm:*::automation-definition/AWSEC2Launch-*:*", - "arn:aws:ssm:*::automation-definition/AWSFIS-*:*", - "arn:aws:ssm:*::automation-definition/AWSFleetManager-*:*", - "arn:aws:ssm:*::automation-definition/AWSIncidents-*:*", - "arn:aws:ssm:*::automation-definition/AWSKinesisTap-*:*", - "arn:aws:ssm:*::automation-definition/AWSMigration-*:*", - "arn:aws:ssm:*::automation-definition/AWSNVMe-*:*", - "arn:aws:ssm:*::automation-definition/AWSNitroEnclavesWindows-*:*", - "arn:aws:ssm:*::automation-definition/AWSObservabilityExporter-*:*", - "arn:aws:ssm:*::automation-definition/AWSPVDriver-*:*", - "arn:aws:ssm:*::automation-definition/AWSQuickSetupType-*:*", - "arn:aws:ssm:*::automation-definition/AWSQuickStarts-*:*", - "arn:aws:ssm:*::automation-definition/AWSRefactorSpaces-*:*", - "arn:aws:ssm:*::automation-definition/AWSResilienceHub-*:*", - "arn:aws:ssm:*::automation-definition/AWSSAP-*:*", - "arn:aws:ssm:*::automation-definition/AWSSAPTools-*:*", - "arn:aws:ssm:*::automation-definition/AWSSQLServer-*:*", - "arn:aws:ssm:*::automation-definition/AWSSSO-*:*", - "arn:aws:ssm:*::automation-definition/AWSSupport-*:*", - "arn:aws:ssm:*::automation-definition/AWSSystemsManagerSAP-*:*", - "arn:aws:ssm:*::automation-definition/AmazonCloudWatch-*:*", - "arn:aws:ssm:*::automation-definition/AmazonCloudWatchAgent-*:*", - "arn:aws:ssm:*::automation-definition/AmazonECS-*:*", - "arn:aws:ssm:*::automation-definition/AmazonEFSUtils-*:*", - "arn:aws:ssm:*::automation-definition/AmazonEKS-*:*", - "arn:aws:ssm:*::automation-definition/AmazonInspector-*:*", - "arn:aws:ssm:*::automation-definition/AmazonInspector2-*:*", - "arn:aws:ssm:*::automation-definition/AmazonInternal-*:*", - "arn:aws:ssm:*::automation-definition/AwsEnaNetworkDriver-*:*", - "arn:aws:ssm:*::automation-definition/AwsVssComponents-*:*" - ], - "Condition": { - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "drs.amazonaws.com" - ] - } - } - }, - { - "Sid": "LaunchActionsPolicy4", - "Effect": "Allow", - "Action": [ - "ssm:SendCommand" - ], - "Resource": [ - "arn:aws:ec2:*:*:instance/*" - ], - "Condition": { - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "drs.amazonaws.com" - ] - }, - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "LaunchActionsPolicy5", - "Effect": "Allow", - "Action": [ - "ssm:SendCommand" - ], - "Resource": [ - "arn:aws:ec2:*:*:instance/*" - ], - "Condition": { - "Null": { - "aws:ResourceTag/AWSDRS": "false" - }, - "StringEquals": { - "aws:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" - }, - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "drs.amazonaws.com" - ] - } - } - }, - { - "Sid": "LaunchActionsPolicy6", - "Effect": "Allow", - "Action": [ - "ssm:ListDocuments", - "ssm:ListCommandInvocations" - ], - "Resource": "*" - }, - { - "Sid": "LaunchActionsPolicy7", - "Effect": "Allow",