AWS Security ChangesHomeSearch

AWS outposts documentation change

Service: outposts · 2025-04-18 · Documentation medium

File: outposts/latest/server-userguide/using-service-linked-roles.md

Summary

Expanded service-linked role documentation with detailed permissions for private connectivity and network security

Security assessment

Adds explicit documentation about security group management, network interface permissions, and secure connectivity requirements without referencing a specific vulnerability

Diff

diff --git a/outposts/latest/server-userguide/using-service-linked-roles.md b/outposts/latest/server-userguide/using-service-linked-roles.md
index 8847ae7bf..dbf0f2a98 100644
--- a//outposts/latest/server-userguide/using-service-linked-roles.md
+++ b//outposts/latest/server-userguide/using-service-linked-roles.md
@@ -17 +17 @@ You can delete a service-linked role only after first deleting the related resou
-AWS Outposts uses the service-linked role named **AWSServiceRoleForOutposts_`OutpostID`** – Allows Outposts to access AWS resources for private connectivity on your behalf. This service-linked role allows private connectivity configuration, creates network interfaces, and attaches them to service link endpoint instances.
+AWS Outposts uses the service-linked role named **AWSServiceRoleForOutposts_`OutpostID`**. This role grants Outposts permissions to manage networking resources to enable private connectivity on your behalf. This role also allows Outposts to create and configure network interfaces, manage security groups, and attach interfaces to service link endpoint instances. These permissions are necessary for establishing and maintaining the secure, private connection between your on-premises Outpost and AWS services, ensuring reliable operation of your Outpost deployment.
@@ -26 +26 @@ The AWSServiceRoleForOutposts_`OutpostID` service-linked role trusts the followi
-The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the following policies: 
+### Service-linked role policies
@@ -28 +28 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f
-  * **AWSOutpostsServiceRolePolicy**
+The AWSServiceRoleForOutposts_`OutpostID` service-linked role includes the following policies:
@@ -30 +30 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f
-  * **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`**
+  * [AWSOutpostsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSOutpostsServiceRolePolicy.html)
@@ -31,0 +32 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f
+  * AWSOutpostsPrivateConnectivityPolicy_`OutpostID`
@@ -35 +36,4 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f
-The **AWSOutpostsServiceRolePolicy** policy is a service-linked role policy to enable access to AWS resources managed by AWS Outposts.
+
+#### AWSOutpostsServiceRolePolicy
+
+The `AWSOutpostsServiceRolePolicy` policy enables access to AWS resources managed by AWS Outposts.
@@ -39 +43,3 @@ This policy allows AWS Outposts to complete the following actions on the specifi
-  * Action: `ec2:DescribeNetworkInterfaces` on `all AWS resources`
+  * Action: `ec2:DescribeNetworkInterfaces` on all AWS resources
+
+  * Action: `ec2:DescribeSecurityGroups` on all AWS resources
@@ -41 +47 @@ This policy allows AWS Outposts to complete the following actions on the specifi
-  * Action: `ec2:DescribeSecurityGroups` on `all AWS resources`
+  * Action: `ec2:CreateSecurityGroup` on all AWS resources
@@ -43 +49 @@ This policy allows AWS Outposts to complete the following actions on the specifi
-  * Action: `ec2:CreateSecurityGroup` on `all AWS resources`
+  * Action: `ec2:CreateNetworkInterface` on all AWS resources
@@ -45 +50,0 @@ This policy allows AWS Outposts to complete the following actions on the specifi
-  * Action: `ec2:CreateNetworkInterface` on `all AWS resources`
@@ -48,0 +54 @@ This policy allows AWS Outposts to complete the following actions on the specifi
+#### AWSOutpostsPrivateConnectivityPolicy_OutpostID
@@ -50 +56 @@ This policy allows AWS Outposts to complete the following actions on the specifi
-The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outposts to complete the following actions on the specified resources:
+The `AWSOutpostsPrivateConnectivityPolicy_`OutpostID`` policy allows AWS Outposts to complete the following actions on the specified resources:
@@ -52 +58 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo
-  * Action: `ec2:AuthorizeSecurityGroupIngress` on `all AWS resources that match the following Condition:`
+  * Action: `ec2:AuthorizeSecurityGroupIngress` on all AWS resources that match the following condition:
@@ -56 +62 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo
-  * Action: `ec2:AuthorizeSecurityGroupEgress` on `all AWS resources that match the following Condition:`
+  * Action: `ec2:AuthorizeSecurityGroupEgress` on all AWS resources that match the following condition:
@@ -60 +66 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo
-  * Action: `ec2:CreateNetworkInterfacePermission` on `all AWS resources that match the following Condition:`
+  * Action: `ec2:CreateNetworkInterfacePermission` on all AWS resources that match the following condition:
@@ -64 +70 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo
-  * Action: `ec2:CreateTags` on `all AWS resources that match the following Condition:`
+  * Action: `ec2:CreateTags` on all AWS resources that match the following condition: