AWS AmazonECS high security documentation change
Summary
Added guidance about using aws:SourceAccount/aws:SourceArn conditions to prevent confused deputy issues. Removed Condition blocks from IAM policy examples.
Security assessment
The change explicitly addresses the confused deputy security problem by recommending IAM condition keys to restrict trust relationships. This directly mitigates a security risk where unauthorized actors could abuse role permissions. The removal of Condition blocks in examples may reduce security posture unless compensated by the new guidance.
Diff
diff --git a/AmazonECS/latest/developerguide/task-iam-roles.md b/AmazonECS/latest/developerguide/task-iam-roles.md index 822edcbe3..f7a409679 100644 --- a//AmazonECS/latest/developerguide/task-iam-roles.md +++ b//AmazonECS/latest/developerguide/task-iam-roles.md @@ -45,0 +46,4 @@ The IAM task role must have a trust policy that specifies the `ecs-tasks.amazona +###### Important + +When creating your task IAM role, it is recommended that you use the `aws:SourceAccount` or `aws:SourceArn` condition keys in the trust relationship policy associated with the role to scope the permissions further to prevent the confused deputy security issue. Using the `aws:SourceArn` condition key to specify a specific cluster is not currently supported, you should use the wildcard to specify all clusters. To learn more about the confused deputy problem and how to protect your AWS account, see [The confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) in the _IAM User Guide_. + @@ -70,5 +74 @@ The IAM task role must have a trust policy that specifies the `ecs-tasks.amazona -###### Important - -When creating your task IAM role, it is recommended that you use the `aws:SourceAccount` or `aws:SourceArn` condition keys in either the trust relationship or the IAM policy associated with the role to scope the permissions further to prevent the confused deputy security issue. Using the `aws:SourceArn` condition key to specify a specific cluster is not currently supported, you should use the wildcard to specify all clusters. To learn more about the confused deputy problem and how to protect your AWS account, see [The confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) in the _IAM User Guide_. - -The following procedures describe how to create a policy to retrieve objects from Amazon S3 with an example policy. Replace all `user input` with your own values. +Use the following procedure to create a policy to retrieve objects from Amazon S3 with an example policy. Replace all `user input` with your own values. @@ -103,9 +103 @@ If this is your first time choosing **Policies** , the **Welcome to Managed Poli - ], - "Condition":{ - "ArnLike":{ - "aws:SourceArn":"arn:aws:ecs:region:123456789012:*" - }, - "StringEquals":{ - "aws:SourceAccount":"123456789012" - } - } + ] @@ -146,9 +138 @@ Replace all `user input` with your own values. - ], - "Condition":{ - "ArnLike":{ - "aws:SourceArn":"arn:aws:ecs:region:123456789012:*" - }, - "StringEquals":{ - "aws:SourceAccount":"123456789012" - } - } + ] @@ -159 +143 @@ Replace all `user input` with your own values. - 2. Use the following command to create the IAM policy using the JSON policy document file. + 2. Use the following command to create the IAM policy using the JSON policy document file. Replace all `user input` with your own values. @@ -168 +152 @@ Replace all `user input` with your own values. -The following procedures describe how to create a task IAM role by attaching an IAM policy that you create. +Use the following procedure to create the service role. @@ -199,2 +182,0 @@ AWS CLI -Replace all `user input` with your own values. - @@ -208,3 +190,5 @@ Replace all `user input` with your own values. - "Principal":{ - "Service":[ - "ecs-tasks.amazonaws.com" + "Action":[ + "s3:GetObject" + ], + "Resource":[ + "arn:aws:s3:::my-task-secrets-bucket/*" @@ -212,10 +195,0 @@ Replace all `user input` with your own values. - }, - "Action":"sts:AssumeRole", - "Condition":{ - "ArnLike":{ - "aws:SourceArn":"arn:aws:ecs:us-west-2:111122223333:*" - }, - "StringEquals":{ - "aws:SourceAccount":"111122223333" - } - }