AWS prometheus documentation change
Summary
Updated IAM policy details with new workspace configuration permissions and policy description
Security assessment
Expands documentation of IAM permissions but shows no evidence of addressing existing security issues
Diff
diff --git a/prometheus/latest/userguide/security-iam-awsmanpol.md b/prometheus/latest/userguide/security-iam-awsmanpol.md index ae4b0c0bd..ca0a0fc40 100644 --- a//prometheus/latest/userguide/security-iam-awsmanpol.md +++ b//prometheus/latest/userguide/security-iam-awsmanpol.md @@ -89 +89 @@ This policy includes the following permissions. - * `aps` – Allows full access to Amazon Managed Service for Prometheus + * The `aps` permissions enable users to create and manage workspaces, and to manage Amazon Managed Service for Prometheus in the console. @@ -91 +91 @@ This policy includes the following permissions. - * `tag` – Allows principals to see tag suggestions in the Amazon Managed Service for Prometheus console. + * The `tag` permissions enable users to see the tags that have been applied to Amazon Managed Service for Prometheus resources. @@ -99,3 +99 @@ This policy includes the following permissions. - "Statement": [ - { - "Sid": "TagSuggestions", + "Statement": [{ @@ -110 +107,0 @@ This policy includes the following permissions. - "Sid": "PrometheusConsoleActions", @@ -132 +129,3 @@ This policy includes the following permissions. - "aps:DescribeLoggingConfiguration" + "aps:DescribeLoggingConfiguration", + "aps:UpdateWorkspaceConfiguration", + "aps:DescribeWorkspaceConfiguration" @@ -303,0 +303 @@ Change | Description | Date +AmazonPrometheusConsoleFullAccessPolicy – Update to an existing policy | Amazon Managed Service for Prometheus added new permissions to **AmazonPrometheusConsoleFullAccessPolicy**. The `aps:UpdateWorkspaceConfiguration` and `aps:DescribeWorkspaceConfiguration` permissions were added so that users with this policy can view and edit workspace configuration information. | April 14, 2025