AWS outposts medium security documentation change
Summary
Expanded documentation of service-linked role permissions including detailed policy actions, resource ARNs, and security-related conditions. Added revoke/delete actions with tag-based restrictions and VPC validation.
Security assessment
Added granular security controls including tag-based resource restrictions (aws:TagKeys conditions) and VPC validation for network interface/security group operations. New revoke/delete actions with resource constraints improve least-privilege documentation.
Diff
diff --git a/outposts/latest/userguide/using-service-linked-roles.md b/outposts/latest/userguide/using-service-linked-roles.md index 11c8af617..4c693bb95 100644 --- a//outposts/latest/userguide/using-service-linked-roles.md +++ b//outposts/latest/userguide/using-service-linked-roles.md @@ -17 +17 @@ You can delete a service-linked role only after first deleting the related resou -AWS Outposts uses the service-linked role named **AWSServiceRoleForOutposts_`OutpostID`** – Allows Outposts to access AWS resources for private connectivity on your behalf. This service-linked role allows private connectivity configuration, creates network interfaces, and attaches them to service link endpoint instances. +AWS Outposts uses the service-linked role named **AWSServiceRoleForOutposts_`OutpostID`**. This role grants Outposts permissions to manage networking resources to enable private connectivity on your behalf. This role also allows Outposts to create and configure network interfaces, manage security groups, and attach interfaces to service link endpoint instances. These permissions are necessary for establishing and maintaining the secure, private connection between your on-premises Outpost and AWS services, ensuring reliable operation of your Outpost deployment. @@ -26 +26 @@ The AWSServiceRoleForOutposts_`OutpostID` service-linked role trusts the followi -The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the following policies: +### Service-linked role policies @@ -28 +28 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f - * **AWSOutpostsServiceRolePolicy** +The AWSServiceRoleForOutposts_`OutpostID` service-linked role includes the following policies: @@ -30 +30 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f - * **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** + * [AWSOutpostsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSOutpostsServiceRolePolicy.html) @@ -31,0 +32 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f + * AWSOutpostsPrivateConnectivityPolicy_`OutpostID` @@ -35 +36,4 @@ The **AWSServiceRoleForOutposts_`OutpostID`** service-linked role includes the f -The **AWSOutpostsServiceRolePolicy** policy is a service-linked role policy to enable access to AWS resources managed by AWS Outposts. + +#### AWSOutpostsServiceRolePolicy + +The `AWSOutpostsServiceRolePolicy` policy enables access to AWS resources managed by AWS Outposts. @@ -39 +43,9 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:DescribeNetworkInterfaces` on `all AWS resources` + * Action: `ec2:DescribeNetworkInterfaces` on all AWS resources + + * Action: `ec2:DescribeSecurityGroups` on all AWS resources + + * Action: `ec2:DescribeSubnets` on all AWS resources + + * Action: `ec2:DescribeVpcEndpoints` on all AWS resources + + * Action: `ec2:CreateNetworkInterface` on the following AWS resources: @@ -41 +53,3 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:DescribeSecurityGroups` on `all AWS resources` + "arn:*:ec2:*:*:vpc/*", + "arn:*:ec2:*:*:subnet/*", + "arn:*:ec2:*:*:security-group/*" @@ -43 +57 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:CreateSecurityGroup` on `all AWS resources` + * Action: `ec2:CreateNetworkInterface` on the AWS resource `"arn:*:ec2:*:*:network-interface/*"` that match the following condition: @@ -45 +59 @@ This policy allows AWS Outposts to complete the following actions on the specifi - * Action: `ec2:CreateNetworkInterface` on `all AWS resources` + "ForAnyValue:StringEquals" : { "aws:TagKeys": [ "outposts:private-connectivity-resourceId" ] } @@ -46,0 +61 @@ This policy allows AWS Outposts to complete the following actions on the specifi + * Action: `ec2:CreateSecurityGroup` on the following AWS resources: @@ -47,0 +63 @@ This policy allows AWS Outposts to complete the following actions on the specifi + "arn:*:ec2:*:*:vpc/*" @@ -48,0 +65 @@ This policy allows AWS Outposts to complete the following actions on the specifi + * Action: `ec2:CreateSecurityGroup` on the AWS resource `"arn:*:ec2:*:*:security-group/*"` that match the following condition: @@ -50 +67 @@ This policy allows AWS Outposts to complete the following actions on the specifi -The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outposts to complete the following actions on the specified resources: + "ForAnyValue:StringEquals": { "aws:TagKeys": [ "outposts:private-connectivity-resourceId" ] } @@ -52 +69,8 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:AuthorizeSecurityGroupIngress` on `all AWS resources that match the following Condition:` + + + +#### AWSOutpostsPrivateConnectivityPolicy_OutpostID + +The `AWSOutpostsPrivateConnectivityPolicy_`OutpostID`` policy allows AWS Outposts to complete the following actions on the specified resources: + + * Action: `ec2:AuthorizeSecurityGroupIngress` on all AWS resources that match the following condition: @@ -56 +80 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:AuthorizeSecurityGroupEgress` on `all AWS resources that match the following Condition:` + * Action: `ec2:AuthorizeSecurityGroupEgress` on all AWS resources that match the following condition: @@ -60 +84 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:CreateNetworkInterfacePermission` on `all AWS resources that match the following Condition:` + * Action: `ec2:CreateNetworkInterfacePermission` on all AWS resources that match the following condition: @@ -64 +88,4 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - * Action: `ec2:CreateTags` on `all AWS resources that match the following Condition:` + * Action: `ec2:CreateTags` on all AWS resources that match the following condition: + + { "StringLike" : { "aws:RequestTag/outposts:private-connectivity-resourceId" : "{{OutpostId}}*"}}, + "StringEquals": {"ec2:CreateAction" : ["CreateSecurityGroup", "CreateNetworkInterface"]} @@ -66 +93,15 @@ The **AWSOutpostsPrivateConnectivityPolicy_`OutpostID`** policy allows AWS Outpo - { "StringLike" : { "aws:RequestTag/outposts:private-connectivity-resourceId" : "{{OutpostId}}*"}} + * Action: `ec2:RevokeSecurityGroupIngress` on all AWS resources that match the following condition: + + { "StringLike" : { "ec2:ResourceTag/outposts:private-connectivity-resourceId" : "OutpostID" }} and { "StringEquals" : { "ec2:Vpc" : "vpcArn" }} + + * Action: `ec2:RevokeSecurityGroupEgress` on all AWS resources that match the following condition: + + { "StringLike" : { "ec2:ResourceTag/outposts:private-connectivity-resourceId" : "OutpostID" }} and { "StringEquals" : { "ec2:Vpc" : "vpcArn" }} + + * Action: `ec2:DeleteNetworkInterface` on all AWS resources that match the following condition: + + { "StringLike" : { "ec2:ResourceTag/outposts:private-connectivity-resourceId" : "OutpostID" }} and { "StringEquals" : { "ec2:Vpc" : "vpcArn" }} + + * Action: `ec2:DeleteSecurityGroup` on all AWS resources that match the following condition: + + { "StringLike" : { "ec2:ResourceTag/outposts:private-connectivity-resourceId" : "OutpostID" }} and { "StringEquals" : { "ec2:Vpc" : "vpcArn" }}