AWS step-functions documentation change
Summary
Standardized ARN patterns with 'account-id' placeholder and corrected case in 'config-id' references
Security assessment
Documentation formatting changes for consistency. No security implications identified in policy examples.
Diff
diff --git a/step-functions/latest/dg/iam-policies-eg-dist-map.md b/step-functions/latest/dg/iam-policies-eg-dist-map.md index da9e29aa9..ac04562fd 100644 --- a//step-functions/latest/dg/iam-policies-eg-dist-map.md +++ b//step-functions/latest/dg/iam-policies-eg-dist-map.md @@ -23 +23 @@ The following IAM policy example grants the least privileges required to your st -Make sure that you replace ``stateMachineName`` with the name of the state machine in which you're using the _Distributed Map state_. For example, `arn:aws:states:`us-east-2`:`123456789012`:stateMachine:`mystateMachine``. +Make sure that you replace ``stateMachineName`` with the name of the state machine in which you're using the _Distributed Map state_. For example, `arn:aws:states:`region`:`account-id`:stateMachine:`mystateMachine``. @@ -35 +35 @@ Make sure that you replace ``stateMachineName`` with the name of the state machi - "arn:aws:states:region:accountID:stateMachine:stateMachineName" + "arn:aws:states:region:account-id:stateMachine:stateMachineName" @@ -43 +43 @@ Make sure that you replace ``stateMachineName`` with the name of the state machi - "Resource": "arn:aws:states:region:accountID:execution:stateMachineName:*" + "Resource": "arn:aws:states:region:account-id:execution:stateMachineName:*" @@ -56 +56 @@ The following IAM policy example grants the least privileges required to your st -Make sure that you replace ``stateMachineName`` with the name of the state machine in which you're using the _Distributed Map state_. For example, `arn:aws:states:`us-east-2`:`123456789012`:stateMachine:`mystateMachine``. +Make sure that you replace ``stateMachineName`` with the name of the state machine in which you're using the _Distributed Map state_. For example, `arn:aws:states:`region`:`account-id`:stateMachine:`mystateMachine``. @@ -67 +67 @@ Make sure that you replace ``stateMachineName`` with the name of the state machi - "Resource": "arn:aws:states:us-east-2:123456789012:execution:myStateMachine/myMapRunLabel:*" + "Resource": "arn:aws:states:us-east-2:account-id:execution:stateMachineName/myMapRunLabel:*" @@ -137,2 +137,2 @@ The following example shows an IAM policy that grants least privileges to access - "arn:aws:s3:::destination-prefix/amzn-s3-demo-bucket/config-ID/YYYY-MM-DDTHH-MMZ/manifest.json", - "arn:aws:s3:::destination-prefix/amzn-s3-demo-bucket/config-ID/data/*" + "arn:aws:s3:::destination-prefix/amzn-s3-demo-bucket/config-id/YYYY-MM-DDTHH-MMZ/manifest.json", + "arn:aws:s3:::destination-prefix/amzn-s3-demo-bucket/config-id/data/*" @@ -184 +184 @@ The following IAM policy example grants permission to the `kms:Decrypt`, `kms:En - "arn:aws:kms:us-east-1:123456789012:key/111aa2bb-333c-4d44-5555-a111bb2c33dd" + "arn:aws:kms:region:account-id:key/111aa2bb-333c-4d44-5555-a111bb2c33dd"