AWS kendra documentation change

Service: kendra · 2025-04-28 · Documentation low

File: kendra/latest/dg/iam-roles.md

Summary

Removed detailed IAM policy examples and documentation related to Amazon WorkDocs data source permissions

Security assessment

The removed content included IAM policies and permissions guidance, but there is no evidence this change addresses a specific security vulnerability. It appears to be routine documentation cleanup.

Diff

diff --git a/kendra/latest/dg/iam-roles.md b/kendra/latest/dg/iam-roles.md
index b825b9143..1094f45f4 100644
--- a//kendra/latest/dg/iam-roles.md
+++ b//kendra/latest/dg/iam-roles.md
@@ -1621,85 +1620,0 @@ A trust policy to allow Amazon Kendra to assume a role.
-    {
-       "Version":"2012-10-17",
-       "Statement":[
-          {
-             "Effect":"Allow",
-             "Principal":{
-                "Service":"kendra.amazonaws.com"
-             },
-             "Action":"sts:AssumeRole"
-          }
-       ]
-    }
-
-When you use Amazon WorkDocs, you provide a role with the following policies
-
-  * Permission to verify the directory ID (organization ID) that corresponds with your Amazon WorkDocs site repository.
-
-  * Permission to get the domain name of your Active Directory that contains your Amazon WorkDocs site directory.
-
-  * Permission to call the required public APIs for the Amazon WorkDocs connector.
-
-  * Permission to call the `BatchPutDocument` and `BatchDeleteDocument` APIs to update the index.
-
-
-
-    
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "AllowsKendraToGetDomainNameOfActiveDirectory",
-          "Effect": "Allow",
-          "Action": "ds:DescribeDirectories",
-          "Resource": "*"
-        },
-        {
-          "Sid": "AllowsKendraToCallRequiredWorkDocsAPIs",
-          "Effect": "Allow",
-          "Action": [
-            "workdocs:GetDocumentPath",
-            "workdocs:GetGroup",
-            "workdocs:GetDocument",
-            "workdocs:DownloadDocumentVersions",
-            "workdocs:DescribeUsers",
-            "workdocs:DescribeFolderContents",
-            "workdocs:DescribeActivities",
-            "workdocs:DescribeComments",
-            "workdocs:GetFolder",
-            "workdocs:DescribeResourcePermissions",
-            "workdocs:GetFolderPath",
-            "workdocs:DescribeInstances"
-          ],
-          "Resource": "*"
-        },
-        {
-          "Sid": "iamPassRole",
-          "Effect": "Allow",
-          "Action": "iam:PassRole",
-          "Resource": "*",
-          "Condition": {
-            "StringEquals": {
-              "iam:PassedToService": [
-                "kendra.amazonaws.com"
-              ]
-            }
-          }
-        },
-        {
-          "Sid": "AllowsKendraToCallBatchPutDeleteAPIs",
-          "Effect": "Allow",
-          "Action": [
-            "kendra:BatchPutDocument",
-            "kendra:BatchDeleteDocument"
-          ],
-          "Resource": [
-            "arn:aws:kendra:your-region:account-id:index/$index-id"
-          ]
-        }
-      ]
-    }
-
-A trust policy to allow Amazon Kendra to assume a role.
-    
-