AWS drs documentation change
Summary
Replaced inline IAM policy JSON with reference to AWS Managed Policy Guide
Security assessment
The change removes detailed policy JSON in favor of linking to official managed policy documentation. While IAM policies are security-related, there's no evidence this change addresses a specific vulnerability. It maintains security documentation by providing authoritative reference.
Diff
diff --git a/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryServiceRolePolicy.md b/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryServiceRolePolicy.md index 4cd2547b7..2b535e54c 100644 --- a//drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryServiceRolePolicy.md +++ b//drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryServiceRolePolicy.md @@ -27,0 +28 @@ This policy includes permissions to do the following: +**Permissions details** @@ -29,428 +30 @@ This policy includes permissions to do the following: - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DRSServiceRolePolicy1", - "Effect": "Allow", - "Action": [ - "drs:ListTagsForResource" - ], - "Resource": "*" - }, - { - "Sid": "DRSServiceRolePolicy2", - "Effect": "Allow", - "Action": [ - "drs:TagResource" - ], - "Resource": "arn:aws:drs:*:*:recovery-instance/*" - }, - { - "Sid": "DRSServiceRolePolicy3", - "Effect": "Allow", - "Action": [ - "drs:CreateRecoveryInstanceForDrs", - "drs:TagResource" - ], - "Resource": "arn:aws:drs:*:*:source-server/*" - }, - { - "Sid": "DRSServiceRolePolicy4", - "Effect": "Allow", - "Action": "iam:GetInstanceProfile", - "Resource": "*" - }, - { - "Sid": "DRSServiceRolePolicy5", - "Effect": "Allow", - "Action": "kms:ListRetirableGrants", - "Resource": "*" - }, - { - "Sid": "DRSServiceRolePolicy6", - "Effect": "Allow", - "Action": [ - "ec2:DescribeAccountAttributes", - "ec2:DescribeAvailabilityZones", - "ec2:DescribeImages", - "ec2:DescribeInstances", - "ec2:DescribeInstanceTypes", - "ec2:DescribeInstanceAttribute", - "ec2:DescribeInstanceStatus", - "ec2:DescribeLaunchTemplateVersions", - "ec2:DescribeLaunchTemplates", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSnapshots", - "ec2:DescribeSubnets", - "ec2:DescribeVolumes", - "ec2:DescribeVolumeAttribute", - "ec2:GetEbsDefaultKmsKeyId", - "ec2:GetEbsEncryptionByDefault", - "ec2:DescribeVpcAttribute", - "ec2:DescribeInternetGateways", - "ec2:DescribeVpcs", - "ec2:DescribeNetworkAcls", - "ec2:DescribeRouteTables", - "ec2:DescribeDhcpOptions", - "ec2:DescribeManagedPrefixLists", - "ec2:GetManagedPrefixListEntries", - "ec2:GetManagedPrefixListAssociations" - ], - "Resource": "*" - }, - { - "Sid": "DRSServiceRolePolicy7", - "Effect": "Allow", - "Action": [ - "ec2:RegisterImage" - ], - "Resource": "*" - }, - { - "Sid": "DRSServiceRolePolicy8", - "Effect": "Allow", - "Action": [ - "ec2:DeregisterImage" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy9", - "Effect": "Allow", - "Action": [ - "ec2:DeleteSnapshot" - ], - "Resource": "arn:aws:ec2:*:*:snapshot/*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy10", - "Effect": "Allow", - "Action": [ - "ec2:CreateLaunchTemplateVersion", - "ec2:ModifyLaunchTemplate", - "ec2:DeleteLaunchTemplate", - "ec2:DeleteLaunchTemplateVersions" - ], - "Resource": "arn:aws:ec2:*:*:launch-template/*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy11", - "Effect": "Allow", - "Action": [ - "ec2:DeleteVolume", - "ec2:ModifyVolume" - ], - "Resource": "arn:aws:ec2:*:*:volume/*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy12", - "Effect": "Allow", - "Action": [ - "ec2:StartInstances", - "ec2:StopInstances", - "ec2:TerminateInstances", - "ec2:ModifyInstanceAttribute", - "ec2:GetConsoleOutput", - "ec2:GetConsoleScreenshot" - ], - "Resource": "arn:aws:ec2:*:*:instance/*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy13", - "Effect": "Allow", - "Action": [ - "ec2:RevokeSecurityGroupEgress", - "ec2:AuthorizeSecurityGroupIngress", - "ec2:AuthorizeSecurityGroupEgress" - ], - "Resource": "arn:aws:ec2:*:*:security-group/*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy14", - "Effect": "Allow", - "Action": [ - "ec2:CreateVolume" - ], - "Resource": "arn:aws:ec2:*:*:volume/*", - "Condition": { - "Null": { - "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" - } - } - }, - { - "Sid": "DRSServiceRolePolicy15", - "Effect": "Allow", - "Action": [ - "ec2:CreateSecurityGroup" - ], - "Resource": "arn:aws:ec2:*:*:security-group/*", - "Condition": { - "Null": { - "aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false" - }