AWS outposts documentation change
Summary
Expanded service-linked role documentation with detailed permissions for private connectivity and network security
Security assessment
Adds explicit documentation about security group management, network interface permissions, and secure connectivity requirements without referencing a specific vulnerability
Diff
diff --git a/outposts/latest/server-userguide/using-service-linked-roles.md b/outposts/latest/server-userguide/using-service-linked-roles.md index 8847ae7bf..dbf0f2a98 100644 --- a//outposts/latest/server-userguide/using-service-linked-roles.md +++ b//outposts/latest/server-userguide/using-service-linked-roles.md @@ -17 +17 @@ You can delete a service-linked role only after first deleting the related resou -AWS Outposts uses the service-linked role named **AWSServiceRoleForOutposts_`OutpostID`** – Allows Outposts to access AWS resources for private connectivity on your behalf. This service-linked role allows private connectivity configuration, creates network interfaces, and attaches them to service link endpoint instances. +AWS Outposts uses the service-linked role named **AWSServiceRoleForOutposts_`OutpostID`**. This role grants Outposts permissions to manage networking resources to enable private connectivity on your behalf. This role also allows Outposts to create and configure network interfaces, manage security groups, and attach interfaces to service link endpoint instances. These permissions are necessary for establishing and maintaining the secure, private connection between your on-premises Outpost and AWS services, ensuring reliable operation of your Outpost deployment. @@ -26 +26 @@ The AWSServiceRoleForOutposts_`OutpostID` service-linked role trusts the followi -The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the following policies: +### Service-linked role policies @@ -28 +28 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f - * **AWSOutpostsServiceRolePolicy** +The AWSServiceRoleForOutposts_`OutpostID` service-linked role includes the following policies: @@ -30 +30 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f - * **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** + * [AWSOutpostsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSOutpostsServiceRolePolicy.html) @@ -31,0 +32 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f + * AWSOutpostsPrivateConnectivityPolicy_`OutpostID` @@ -35 +36,4 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f -The **AWSOutpostsServiceRolePolicy** policy is a service-linked role policy to enable access to AWS resources managed by AWS Outposts. + +#### AWSOutpostsServiceRolePolicy + +The `AWSOutpostsServiceRolePolicy` policy enables access to AWS resources managed by AWS Outposts. @@ -39 +43,3 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:DescribeNetworkInterfaces` on `all AWS resources` + * Action: `ec2:DescribeNetworkInterfaces` on all AWS resources + + * Action: `ec2:DescribeSecurityGroups` on all AWS resources @@ -41 +47 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:DescribeSecurityGroups` on `all AWS resources` + * Action: `ec2:CreateSecurityGroup` on all AWS resources @@ -43 +49 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:CreateSecurityGroup` on `all AWS resources` + * Action: `ec2:CreateNetworkInterface` on all AWS resources @@ -45 +50,0 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:CreateNetworkInterface` on `all AWS resources` @@ -48,0 +54 @@ This policy allows AWS Outposts to complete the following actions on the specifi +#### AWSOutpostsPrivateConnectivityPolicy_OutpostID @@ -50 +56 @@ This policy allows AWS Outposts to complete the following actions on the specifi -The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outposts to complete the following actions on the specified resources: +The `AWSOutpostsPrivateConnectivityPolicy_`OutpostID`` policy allows AWS Outposts to complete the following actions on the specified resources: @@ -52 +58 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:AuthorizeSecurityGroupIngress` on `all AWS resources that match the following Condition:` + * Action: `ec2:AuthorizeSecurityGroupIngress` on all AWS resources that match the following condition: @@ -56 +62 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:AuthorizeSecurityGroupEgress` on `all AWS resources that match the following Condition:` + * Action: `ec2:AuthorizeSecurityGroupEgress` on all AWS resources that match the following condition: @@ -60 +66 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:CreateNetworkInterfacePermission` on `all AWS resources that match the following Condition:` + * Action: `ec2:CreateNetworkInterfacePermission` on all AWS resources that match the following condition: @@ -64 +70 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:CreateTags` on `all AWS resources that match the following Condition:` + * Action: `ec2:CreateTags` on all AWS resources that match the following condition: