AWS dms medium security documentation change

Service: dms · 2025-04-20 · Security-related medium

File: dms/latest/userguide/security-iam.md

Summary

Updated IAM policy details for AmazonDMSVPCManagementRole including new policy version (v4), added permissions (ec2:DeleteNetworkInterface, ec2:DescribeDhcpOptions, ec2:DescribeNetworkInterfaces), and resource wildcard

Security assessment

The change introduces expanded IAM permissions (including network interface management) and modifies resource restrictions to a wildcard. This could indicate either a security hardening (adding required permissions) or a potential over-permissioning risk (wildcard resource). The policy version update and new permissions suggest security relevance.

Diff

diff --git a/dms/latest/userguide/security-iam.md b/dms/latest/userguide/security-iam.md
index 8a0430be5..bf86e863e 100644
--- a//dms/latest/userguide/security-iam.md
+++ b//dms/latest/userguide/security-iam.md
@@ -323,4 +322,0 @@ The information returned from the command is as follows.
-            "Description": "Provides access to manage VPC settings for AWS managed customer configurations", 
-            "CreateDate": "2015-11-18T16:33:19Z", 
-            "AttachmentCount": 1, 
-            "IsAttachable": true, 
@@ -328,2 +323,0 @@ The information returned from the command is as follows.
-            "DefaultVersionId": "v3", 
-            "Path": "/service-role/", 
@@ -331 +325,9 @@ The information returned from the command is as follows.
-            "UpdateDate": "2016-05-23T16:29:57Z"
+            "Path": "/service-role/",
+            "DefaultVersionId": "v4",
+            "AttachmentCount": 1,
+            "PermissionsBoundaryUsageCount": 0,
+            "IsAttachable": true,
+            "Description": "Provides access to manage VPC settings for AWS managed customer configurations",
+            "CreateDate": "2015-11-18T16:33:19+00:00",
+            "UpdateDate": "2024-07-25T15:19:01+00:00",
+            "Tags": []
@@ -339 +341 @@ The following `get-policy-version` command retrieves IAM policy information.
-    aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole --version-id v3
+    aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole --version-id v4
@@ -347,2 +348,0 @@ The information returned from the command is as follows.
-            "CreateDate": "2016-05-23T16:29:57Z", 
-            "VersionId": "v3", 
@@ -352,0 +353,2 @@ The information returned from the command is as follows.
+                        "Sid": "Statement1",
+                        "Effect": "Allow",
@@ -354,0 +357 @@ The information returned from the command is as follows.
+                            "ec2:DeleteNetworkInterface",
@@ -355,0 +359 @@ The information returned from the command is as follows.
+                            "ec2:DescribeDhcpOptions",
@@ -356,0 +361 @@ The information returned from the command is as follows.
+                            "ec2:DescribeNetworkInterfaces",
@@ -360 +364,0 @@ The information returned from the command is as follows.
-                        "ec2:DeleteNetworkInterface", 
@@ -363,2 +367 @@ The information returned from the command is as follows.
-                    "Resource": "arn:aws:service:region:account:resourcetype/id", 
-                    "Effect": "Allow"
+                        "Resource": "*"
@@ -368 +371,3 @@ The information returned from the command is as follows.
-        "IsDefaultVersion": true
+            "VersionId": "v4",
+            "IsDefaultVersion": true,
+            "CreateDate": "2024-07-25T15:19:01+00:00"