AWS AWSEC2 documentation change
Summary
Updated documentation structure for EC2 Serial Console access management, added PowerShell examples, restructured CLI/console instructions, and improved navigation links
Security assessment
The changes improve documentation about managing access controls for the EC2 Serial Console (a security-sensitive feature), but there's no evidence of addressing a specific vulnerability. Enhancements include additional PowerShell examples and clearer IAM policy guidance, which strengthens security documentation without indicating a patched issue.
Diff
diff --git a/AWSEC2/latest/UserGuide/configure-access-to-serial-console.md b/AWSEC2/latest/UserGuide/configure-access-to-serial-console.md index 1d544eec6..fa77174f0 100644 --- a//AWSEC2/latest/UserGuide/configure-access-to-serial-console.md +++ b//AWSEC2/latest/UserGuide/configure-access-to-serial-console.md @@ -5 +5 @@ -Levels of accessManage account access to the EC2 Serial ConsoleConfigure IAM policies for EC2 Serial Console accessSet an OS user password on a Linux instance +Levels of accessManage account accessConfigure IAM policiesSet an OS user password on a Linux instance @@ -13 +13 @@ Before commencing, be sure to check the [prerequisites](./ec2-serial-console-pre -###### Topics +###### Contents @@ -60 +60 @@ This setting is configured at the account level, either directly in the account -###### Topics +###### Contents @@ -62 +62 @@ This setting is configured at the account level, either directly in the account - * Grant permission to users to manage account access + * [Grant permission to users to manage account access](./configure-access-to-serial-console.html#sc-account-access-permissions) @@ -64 +64 @@ This setting is configured at the account level, either directly in the account - * View account access status to the serial console + * [View account access status to the serial console](./configure-access-to-serial-console.html#sc-view-account-access) @@ -66 +66 @@ This setting is configured at the account level, either directly in the account - * Grant account access to the serial console + * [Grant account access to the serial console](./configure-access-to-serial-console.html#sc-grant-account-access) @@ -68 +68 @@ This setting is configured at the account level, either directly in the account - * Deny account access to the serial console + * [Deny account access to the serial console](./configure-access-to-serial-console.html#sc-deny-account-access) @@ -99 +99,4 @@ For more information, see [Creating IAM policies](https://docs.aws.amazon.com/IA -###### To view account access status to the serial console (console) +Console + + +###### To view account access to the serial console @@ -107,3 +110 @@ For more information, see [Creating IAM policies](https://docs.aws.amazon.com/IA -The **EC2 Serial Console access** field indicates whether account access is **Allowed** or **Prevented**. - -The following screenshot shows that the account is prevented from using the EC2 serial console. + 4. On the **EC2 Serial Console** tab, the value of **EC2 Serial Console access** is either **Allowed** or **Prevented**. @@ -111 +111,0 @@ The following screenshot shows that the account is prevented from using the EC2 - @@ -114,0 +115 @@ The following screenshot shows that the account is prevented from using the EC2 +AWS CLI @@ -116 +116,0 @@ The following screenshot shows that the account is prevented from using the EC2 -###### To view account access status to the serial console (AWS CLI) @@ -118 +118 @@ The following screenshot shows that the account is prevented from using the EC2 -Use the [get-serial-console-access-status](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/get-serial-console-access-status.html) command to view account access status to the serial console. +###### To view account access to the serial console @@ -119,0 +120 @@ Use the [get-serial-console-access-status](https://awscli.amazonaws.com/v2/docum +Use the [get-serial-console-access-status](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/get-serial-console-access-status.html) command. @@ -121 +121,0 @@ Use the [get-serial-console-access-status](https://awscli.amazonaws.com/v2/docum - aws ec2 get-serial-console-access-status --region us-east-1 @@ -123 +123 @@ Use the [get-serial-console-access-status](https://awscli.amazonaws.com/v2/docum -In the following output, `true` indicates that the account is allowed access to the serial console. + aws ec2 get-serial-console-access-status @@ -125 +125 @@ In the following output, `true` indicates that the account is allowed access to -The `ManagedBy` field indicates the entity that configured the setting. In this example, `account` indicates that the setting was configured directly in the account. A value of `declarative-policy` would mean the setting was configured by a declarative policy. For more information, see [Declarative policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html) in the _AWS Organizations User Guide_. +The following is example output. A value of `true` indicates that the account is allowed access to the serial console. @@ -132,0 +133,21 @@ The `ManagedBy` field indicates the entity that configured the setting. In this +The `ManagedBy` field indicates the entity that configured the setting. The possible values are `account` (configured directly) or `declarative-policy`. For more information, see [Declarative policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html) in the _AWS Organizations User Guide_. + +PowerShell + + +###### To view account access to the serial console + +Use the [Get-EC2SerialConsoleAccessStatus](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2SerialConsoleAccessStatus.html) cmdlet. + + + Get-EC2SerialConsoleAccessStatus -Select * + +The following is example output. A value of `True` indicates that the account is allowed access to the serial console. + + + ManagedBy SerialConsoleAccessEnabled + --------- -------------------------- + account True + +The `ManagedBy` field indicates the entity that configured the setting. The possible values are `account` (configured directly) or `declarative-policy`. For more information, see [Declarative policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html) in the _AWS Organizations User Guide_. + @@ -135 +156,4 @@ The `ManagedBy` field indicates the entity that configured the setting. In this -###### To grant account access to the serial console (console) +Console + + +###### To grant account access to the serial console @@ -152 +176,4 @@ The `ManagedBy` field indicates the entity that configured the setting. In this -###### To grant account access to the serial console (AWS CLI) +AWS CLI + + +###### To grant account access to the serial console @@ -154 +181 @@ The `ManagedBy` field indicates the entity that configured the setting. In this -Use the [enable-serial-console-access](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/enable-serial-console-access.html) command to allow account access to the serial console. +Use the [enable-serial-console-access](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/enable-serial-console-access.html) command. @@ -157 +184 @@ Use the [enable-serial-console-access](https://awscli.amazonaws.com/v2/documenta - aws ec2 enable-serial-console-access --region us-east-1 + aws ec2 enable-serial-console-access @@ -159 +186 @@ Use the [enable-serial-console-access](https://awscli.amazonaws.com/v2/documenta -In the following output, `true` indicates that the account is allowed access to the serial console. +The following is example output. @@ -165,0 +193,15 @@ In the following output, `true` indicates that the account is allowed access to +PowerShell + + +###### To grant account access to the serial console + +Use the [Enable-EC2SerialConsoleAccess](https://docs.aws.amazon.com/powershell/latest/reference/items/Enable-EC2SerialConsoleAccess.html) cmdlet. + + + Enable-EC2SerialConsoleAccess + +The following is example output. + + + True + @@ -168 +210,4 @@ In the following output, `true` indicates that the account is allowed access to -###### To deny account access to the serial console (console) +Console + + +###### To deny account access to the serial console @@ -185 +230,2 @@ In the following output, `true` indicates that the account is allowed access to -###### To deny account access to the serial console (AWS CLI) +AWS CLI + @@ -187 +233 @@ In the following output, `true` indicates that the account is allowed access to -Use the [disable-serial-console-access](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disable-serial-console-access.html) command to prevent account access to the serial console. +###### To deny account access to the serial console @@ -188,0 +235 @@ Use the [disable-serial-console-access](https://awscli.amazonaws.com/v2/document +Use the [disable-serial-console-access](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disable-serial-console-access.html) command. @@ -190 +236,0 @@ Use the [disable-serial-console-access](https://awscli.amazonaws.com/v2/document - aws ec2 disable-serial-console-access --region us-east-1 @@ -192 +238,3 @@ Use the [disable-serial-console-access](https://awscli.amazonaws.com/v2/document -In the following output, `false` indicates that the account is denied access to the serial console. + aws ec2 disable-serial-console-access + +The following is example output. @@ -198,0 +247,15 @@ In the following output, `false` indicates that the account is denied access to +PowerShell + + +###### To deny account access to the serial console + +Use the [Disable-EC2SerialConsoleAccess](https://docs.aws.amazon.com/powershell/latest/reference/items/Disable-EC2SerialConsoleAccess.html) cmdlet. + + + Disable-EC2SerialConsoleAccess + +The following is example output. + + + False +