AWS proton documentation change
Summary
Added TagResource/UntagResource permissions, structured policy documentation with SIDs, and formatting improvements
Security assessment
Adds missing CloudFormation tagging permissions and clarifies IAM policy structure. While this improves security documentation completeness, there is no explicit evidence of addressing an active security vulnerability.
Diff
diff --git a/proton/latest/userguide/using-service-linked-roles-codebuild.md b/proton/latest/userguide/using-service-linked-roles-codebuild.md index 5b876c519..2b1c90725 100644 --- a//proton/latest/userguide/using-service-linked-roles-codebuild.md +++ b//proton/latest/userguide/using-service-linked-roles-codebuild.md @@ -21 +21 @@ AWS Proton uses the service-linked role named **AWSServiceRoleForProtonCodeBuild -The AWSServiceRoleForProtonCodeBuildProvisioning service-linked role trusts the following services to assume the role: +The **AWSServiceRoleForProtonCodeBuildProvisioning** service-linked role trusts the following services to assume the role: @@ -28 +28 @@ The AWSServiceRoleForProtonCodeBuildProvisioning service-linked role trusts the -The role permissions policy named AWSProtonCodeBuildProvisioningServiceRolePolicy allows AWS Proton to complete the following actions on the specified resources: +The role permissions policy named `AWSProtonCodeBuildProvisioningServiceRolePolicy` allows AWS Proton to complete the following actions on the specified resources: @@ -43,0 +44 @@ This policy includes the following permissions: + "Sid": "CloudFormationPermissions", @@ -53 +54,3 @@ This policy includes the following permissions: - "cloudformation:ListStackResources" + "cloudformation:ListStackResources", + "cloudformation:TagResource", + "cloudformation:UntagResource" @@ -59,0 +63 @@ This policy includes the following permissions: + "Sid": "CodeBuildPermissions", @@ -73,0 +78 @@ This policy includes the following permissions: + "Sid": "PassRolePermissions", @@ -83,0 +89 @@ This policy includes the following permissions: + "Sid": "ServiceQuotaPermissions", @@ -92,0 +99,2 @@ This policy includes the following permissions: +For more information about this policy, see [AWS managed policy: AWSProtonCodeBuildProvisioningServiceRolePolicy](./security-iam-awsmanpol.html#security-iam-awsmanpol-AWSProtonCodeBuildProvisioningServiceRolePolicy). + @@ -103 +111 @@ If you delete this service-linked role, and then need to create it again, you ca -AWS Proton does not allow you to edit the AWSServiceRoleForProtonCodeBuildProvisioning service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. +AWS Proton does not allow you to edit the **AWSServiceRoleForProtonCodeBuildProvisioning** service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. @@ -111 +119 @@ If you no longer need to use a feature or service that requires a service-linked -Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForProtonCodeBuildProvisioning service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_. +Use the IAM console, the AWS CLI, or the AWS API to delete the **AWSServiceRoleForProtonCodeBuildProvisioning** service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_.