AWS proton documentation change
Summary
Updated IAM policy documentation with formatting improvements, added CloudFormation tagging permissions to CodeBuild provisioning policy, corrected policy name capitalization, added documentation links for service-linked roles, and restructured policy update history.
Security assessment
Changes primarily involve documentation formatting, adding missing permissions (TagResource/UntagResource) for operational needs, and clarifying service-linked role references. No explicit mention of vulnerability fixes or security incidents addressed.
Diff
diff --git a/proton/latest/userguide/security-iam-awsmanpol.md b/proton/latest/userguide/security-iam-awsmanpol.md index d71a7c6b6..fd6c08fd1 100644 --- a//proton/latest/userguide/security-iam-awsmanpol.md +++ b//proton/latest/userguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AWSProtonFullAccessAWSProtonDeveloperAccessAWSProtonReadOnlyAccessAWSProtonSyncServiceRolePolicyAWSProtonCodeBuildProvisioningBasicAccessAWSProtonCodeBuildProvisioningServiceRolePolicyAwsProtonServiceGitSyncServiceRolePolicyPolicy updates +AWSProtonFullAccessAWSProtonDeveloperAccessAWSProtonReadOnlyAccessAWSProtonSyncServiceRolePolicyAWSProtonCodeBuildProvisioningBasicAccessAWSProtonCodeBuildProvisioningServiceRolePolicyAWSProtonServiceGitSyncServiceRolePolicyPolicy updates @@ -42 +42 @@ The following trust relationship is used for each of the AWS Proton managed poli -You can attach AWSProtonFullAccess to your IAM entities. AWS Proton also attaches this policy to a service role that allows AWS Proton to perform actions on your behalf. +You can attach `AWSProtonFullAccess` to your IAM entities. AWS Proton also attaches this policy to a service role that allows AWS Proton to perform actions on your behalf. @@ -150 +150 @@ This policy includes the following permissions. -You can attach AWSProtonDeveloperAccess to your IAM entities. AWS Proton also attaches this policy to a service role that allows AWS Proton to perform actions on your behalf. +You can attach `AWSProtonDeveloperAccess` to your IAM entities. AWS Proton also attaches this policy to a service role that allows AWS Proton to perform actions on your behalf. @@ -268 +268 @@ This policy includes the following permissions. -You can attach AWSProtonReadOnlyAccess to your IAM entities. AWS Proton also attaches this policy to a service role that allows AWS Proton to perform actions on your behalf. +You can attach `AWSProtonReadOnlyAccess` to your IAM entities. AWS Proton also attaches this policy to a service role that allows AWS Proton to perform actions on your behalf. @@ -341 +341 @@ This policy includes the following permissions. -AWS Proton attaches this policy to the AWSServiceRoleForProtonSync service-linked role that allows AWS Proton to perform template sync. +AWS Proton attaches this policy to the [AWSServiceRoleForProtonSync](./using-service-linked-roles-sync.html) service-linked role that allows AWS Proton to perform template sync. @@ -354,2 +353,0 @@ The policy includes the following key action namespaces: -For information on the permission details for the AWSProtonSyncServiceRolePolicy, see [Service-linked role permissions for AWS Proton](https://docs.aws.amazon.com/proton/latest/userguide/using-service-linked-roles-sync.html). - @@ -398 +396 @@ This policy includes the following permissions. -AWS Proton attaches this policy to the AWSServiceRoleForProtonCodeBuildProvisioning service-linked role that allows AWS Proton to perform CodeBuild-based provisioning. +AWS Proton attaches this policy to the [AWSServiceRoleForProtonCodeBuildProvisioning](./using-service-linked-roles-codebuild.html) service-linked role that allows AWS Proton to perform CodeBuild-based provisioning. @@ -421,0 +420 @@ This policy includes the following permissions. + "Sid": "CloudFormationPermissions", @@ -431 +430,3 @@ This policy includes the following permissions. - "cloudformation:ListStackResources" + "cloudformation:ListStackResources", + "cloudformation:TagResource", + "cloudformation:UntagResource" @@ -437,0 +439 @@ This policy includes the following permissions. + "Sid": "CodeBuildPermissions", @@ -451,0 +454 @@ This policy includes the following permissions. + "Sid": "PassRolePermissions", @@ -461,0 +465 @@ This policy includes the following permissions. + "Sid": "ServiceQuotaPermissions", @@ -471 +475 @@ This policy includes the following permissions. -## AWS managed policy: AwsProtonServiceGitSyncServiceRolePolicy +## AWS managed policy: AWSProtonServiceGitSyncServiceRolePolicy @@ -473 +477 @@ This policy includes the following permissions. -AWS Proton attaches this policy to the AwsProtonServiceGitSyncServiceRolePolicy service-linked role that allows AWS Proton to perform service sync. +AWS Proton attaches this policy to the [AWSServiceRoleForProtonServiceSync](./using-service-linked-roles-sync.html) service-linked role that allows AWS Proton to perform service sync. @@ -484,2 +487,0 @@ The policy includes the following key action namespaces: -For information on the permission details for the AwsProtonServiceGitSyncServiceRolePolicy, see [Service-linked role permissions for AWS Proton](https://docs.aws.amazon.com/proton/latest/userguide/using-service-linked-roles-sync.html). - @@ -492,3 +494,4 @@ Change | Description | Date -[`AWSProtonFullAccess`](https://docs.aws.amazon.com/proton/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AWSProtonFullAccess) – Update to an existing policy | The managed policy for the service-linked role to use Git sync with Git repositories has been updated for resources with both service prefixes. For more information, see [Using service-linked roles for AWS CodeConnections](https://docs.aws.amazon.com/dtconsole/latest/userguide/what-is-dtconsole.html) and [Managed policies](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam-awsmanpol.html). | April 25, 2024 -[`AWSProtonDeveloperAccess`](https://docs.aws.amazon.com/proton/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AWSProtonDeveloperAccess) – Update to an existing policy | The managed policy for the service-linked role to use Git sync with Git repositories has been updated for resources with both service prefixes. For more information, see [Using service-linked roles for AWS CodeConnections](https://docs.aws.amazon.com/dtconsole/latest/userguide/what-is-dtconsole.html) and [Managed policies](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam-awsmanpol.html). | April 25, 2024 -[`AWSProtonSyncServiceRolePolicy`](https://docs.aws.amazon.com/proton/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AWSProtonSyncServiceRolePolicy) – Update to an existing policy | The managed policy for the service-linked role to use Git sync with Git repositories has been updated for resources with both service prefixes. For more information, see [Using service-linked roles for AWS CodeConnections](https://docs.aws.amazon.com/dtconsole/latest/userguide/what-is-dtconsole.html) and [Managed policies](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam-awsmanpol.html). | April 25, 2024 +AWSProtonCodeBuildProvisioningServiceRolePolicy – Update to an existing policy | The managed policy for the service-linked role that allows AWS Proton to perform CodeBuild-based provisioning now grants permissions to call the CloudFormation `TagResource` and `UntagResource` API actions. These permissions are required to perform tagging operations on resources. | June 15, 2024 +AWSProtonFullAccess – Update to an existing policy | The managed policy for the service-linked role to use Git sync with Git repositories has been updated for resources with both service prefixes. For more information, see [Using service-linked roles for AWS CodeConnections](https://docs.aws.amazon.com/dtconsole/latest/userguide/what-is-dtconsole.html) and [Managed policies](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam-awsmanpol.html). | April 25, 2024 +AWSProtonDeveloperAccess – Update to an existing policy | The managed policy for the service-linked role to use Git sync with Git repositories has been updated for resources with both service prefixes. For more information, see [Using service-linked roles for AWS CodeConnections](https://docs.aws.amazon.com/dtconsole/latest/userguide/what-is-dtconsole.html) and [Managed policies](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam-awsmanpol.html). | April 25, 2024 +AWSProtonSyncServiceRolePolicy – Update to an existing policy | The managed policy for the service-linked role to use Git sync with Git repositories has been updated for resources with both service prefixes. For more information, see [Using service-linked roles for AWS CodeConnections](https://docs.aws.amazon.com/dtconsole/latest/userguide/what-is-dtconsole.html) and [Managed policies](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam-awsmanpol.html). | April 25, 2024 @@ -496 +499 @@ AWSProtonCodeBuildProvisioningServiceRolePolicy – Update to an existing policy -AwsProtonServiceGitSyncServiceRolePolicy – New policy | AWS Proton added a new policy to allow AWS Proton to perform service syncing. The policy is used in the [AWSServiceRoleForProtonServiceSync](https://docs.aws.amazon.com/proton/latest/userguide/using-service-linked-roles-sync.html#service-linked-role-permissions-sync) service-linked role. | March 31, 2023 +AWSProtonServiceGitSyncServiceRolePolicy – New policy | AWS Proton added a new policy to allow AWS Proton to perform service syncing. The policy is used in the [AWSServiceRoleForProtonServiceSync](https://docs.aws.amazon.com/proton/latest/userguide/using-service-linked-roles-sync.html#service-linked-role-permissions-sync) service-linked role. | March 31, 2023 @@ -500 +503 @@ AWSProtonCodeBuildProvisioningBasicAccess – New policy | AWS Proton added a n -AWSProtonCodeBuildProvisioningServiceRolePolicy – New policy | AWS Proton added a new policy to allow AWS Proton to perform operations related to CodeBuild-based provisioning. The policy is used in the [AWSServiceRoleForProtonCodeBuildProvisioning](./using-service-linked-roles-codebuild.html) service-linked role. | September 02, 2022 +AWSProtonSyncServiceRolePolicy – New policy | AWS Proton added a new policy to allow AWS Proton to perform operations related to CodeBuild-based provisioning. The policy is used in the [AWSServiceRoleForProtonCodeBuildProvisioning](./using-service-linked-roles-codebuild.html) service-linked role. | September 02, 2022