AWS datazone medium security documentation change
Summary
Updated user management documentation to clarify IAM permission requirements, deactivation procedures, SSO user visibility, and removed billing references. Added guidance for restricting programmatic access when deactivating users.
Security assessment
The change adds a link to 'Restricting access to Amazon DataZone' when deactivating IAM users, addressing potential programmatic access gaps. It also specifies the exact IAM permission (`datazone:GetUserPortalLoginUrl`) required for activation, ensuring least-privilege adherence. These updates directly improve security documentation and mitigate risks of unauthorized access.
Diff
diff --git a/datazone/latest/userguide/user-management-console.md b/datazone/latest/userguide/user-management-console.md index 2664e987b..b0ff0d6fe 100644 --- a//datazone/latest/userguide/user-management-console.md +++ b//datazone/latest/userguide/user-management-console.md @@ -9 +9 @@ Manage IAM roles and usersManage SSO usersManage SSO groups -Your users can access the Amazon DataZone data portal by using either their AWS credentials or single sign-on (SSO) credentials. To manage users in the Amazon DataZone console for an Amazon DataZone domain, you must assume an IAM role in the account with administrative permissions. [Configure the IAM permissions required to use the Amazon DataZone management console](./create-iam-roles.html) to obtain the minimum permissions necessary to manage users in the Amazon DataZone console. +Your users can access the Amazon DataZone data portal by using either their AWS credentials or single sign-on (SSO) credentials. To manage users in the Amazon DataZone console for an Amazon DataZone domain, you must assume an IAM role in the account with Amazon DataZone management console permissions. [Configure the IAM permissions required to use the Amazon DataZone management console](./create-iam-roles.html) to obtain the minimum permissions necessary to manage users in the Amazon DataZone console. @@ -46 +46 @@ IAM roles and users are created using AWS Identity and Access Management (IAM) a - * Activated means that the IAM user or role has called an API, issued a command (via Command Line Interface), or accessed the Amazon DataZone portal for your domain, and you are being billed for the user’s subscription. + * Activated means that the IAM user or role has called an API, issued a command (via Command Line Interface), or accessed the Amazon DataZone portal for your domain. @@ -48 +48 @@ IAM roles and users are created using AWS Identity and Access Management (IAM) a - * Deactivated means that the IAM user or role has their access blocked to your Amazon DataZone domain. + * Deactivated means that the IAM user or role can no longer use the Amazon DataZone Data Portal. To restrict programmatic access see [Restricting access to Amazon DataZone](./user-management-portal-restricting-programmatic-access.html). @@ -50 +50 @@ IAM roles and users are created using AWS Identity and Access Management (IAM) a - 7. To deactivate an IAM user or role that is currently activated, check the box next to the user and select **Deactivate** from the **Actions** menu. The user will lose access to the Amazon DataZone domain. Billing for the user will end at the end of the current calendar month. + 7. To deactivate an IAM user or role that is currently activated, check the box next to the user and select **Deactivate** from the **Actions** menu. This will result in the user no longer be able to use the Amazon DataZone Data Portal. To restrict programmatic access see [Restricting access to Amazon DataZone](./user-management-portal-restricting-programmatic-access.html). @@ -52 +52 @@ IAM roles and users are created using AWS Identity and Access Management (IAM) a - 8. To activate an IAM user or role that is currently deactivated, check the box next to the user and select **Activate** from the **Actions** menu. The user will gain access to the Amazon DataZone domain if the IAM user or role has appropriate permissions. Billing for the user will start again. + 8. To activate an IAM user or role that is currently deactivated, check the box next to the user and select **Activate** from the **Actions** menu. The user will gain access to the Amazon DataZone Data Portal if the IAM user or role has `datazone:GetUserPortalLoginUrl` permissions. @@ -59 +59 @@ IAM roles and users are created using AWS Identity and Access Management (IAM) a -SSO users are created or synchronized with your identity provider in AWS IAM Identity Center. For more information, see [Setting up AWS IAM Identity Center for Amazon DataZone](./sso-setup.html) and [Enable IAM Identity Center for Amazon DataZone](./enable-IAM-identity-center-for-datazone.html) to enable and configure AWS IAM Identity Center for Amazon DataZone. You can view the list of SSO users assigned to the domain, add SSO users, and remove SSO users. +SSO users are created or synchronized with your identity provider. For more information, see [Setting up AWS IAM Identity Center for Amazon DataZone](./sso-setup.html) and [Enable IAM Identity Center for Amazon DataZone](./enable-IAM-identity-center-for-datazone.html) to enable and configure AWS IAM Identity Center for Amazon DataZone. You can view the list of SSO users assigned to the domain, add SSO users, and remove SSO users. @@ -67 +67 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - 4. For user type, select **SSO Users** to view the current list of SSO users. + 4. For user type, select **SSO Users** to view the current list of SSO users who have previously authenticated to the data portal. When using implicit user assignment, SSO users who have not previously authenticated to the data portal will not be listed. @@ -75 +75 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - * Activated means that the SSO user has accessed the Amazon DataZone portal for the domain and you are being billed for the user’s subscription. Activation happens automatically. + * Activated means that the SSO user has accessed the Amazon DataZone portal for the domain. Activation happens automatically. @@ -77 +77 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - * Deactivated means that the SSO user’s access is blocked to the domain’s data portal. Billing for the user ended at the end of the month in which their access was deactivated. + * Deactivated means that the SSO user’s access is blocked to the domain’s data portal. @@ -79 +79 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - * Removed means that the SSO user was previously assigned to the domain, but removed before they ever accessed. + * Removed means that the SSO user was previously assigned to the domain, but removed before they ever accessed it. @@ -91 +91 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - * When the user first accessed the domain’s data portal, the status will change automatically to **Activated** , and you will start being billed for the user’s subscription. + * When the user first accessed the domain’s data portal, the status will change automatically to **Activated**. @@ -93 +93 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - 6. Remove an **Assigned** SSO user by selecting the user and choosing **Disable** from the **Actions** menu. As a result, the user will lose access to the Amazon DataZone domain. The user’s status will show as **Removed**. This option is unavailable if the domain is set to implicit user assignment. + 6. Remove an **Assigned** SSO user by selecting the user and choosing **Unassign** from the **Actions** menu. As a result, the user will lose access to the Amazon DataZone domain. The user’s status will show as **Not assigned**. This option is unavailable if the domain is set to implicit user assignment. @@ -95 +95 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - 7. Deactivate an **Activated** SSO user by selecting the user and choosing **Deactivate** from the **Actions** menu. As a result, the user’s access to the Amazon DataZone domain will be lost and blocked. Billing will continue for the user’s subscription until the end of the month. The user’s status will show as **Deactivated**. + 7. Deactivate an **Activated** SSO user by selecting the user and choosing **Deactivate** from the **Actions** menu. As a result, the user’s access to the Amazon DataZone data portal will be lost and blocked. The user’s status will show as **Deactivated**. @@ -97 +97 @@ SSO users are created or synchronized with your identity provider in AWS IAM Ide - 8. Activate a **Deactivated** SSO user by selecting the user and choosing **Activate** from the **Actions** menu. As a result, the user will regain access to the Amazon DataZone domain. Billing will begin immediately. The user’s will show as **Activated**. + 8. Activate a **Deactivated** SSO user by selecting the user and choosing **Activate** from the **Actions** menu. As a result, the user will regain access to the Amazon DataZone data portal. The user’s will show as **Activated**. @@ -132 +132 @@ SSO groups are created or synchronized with your identity provider in AWS IAM Id - * When a member of the group accesses the domain's data portal, the status will change automatically to **Activated** , and you will start being billed for the user’s subscription. + * When a member of the group accesses the domain's data portal, the status will change automatically to **Activated**. @@ -134 +134 @@ SSO groups are created or synchronized with your identity provider in AWS IAM Id - 6. Remove an **Assigned SSO group** by selecting the group and choosing **Unassign** from the **Actions** menu. As a result, the group will lose access to the Amazon DataZone domain. The group’s status will show as **Not Assigned**. Users that gained their access to Amazon DataZone via their membership in this group will lose access. This option is unavailable if the domain is set to implicit user assignment. To stop billing for users whose access is removed by unassigning their group, you will need to next manually select and **Deactivate** their user profiles. + 6. Remove an **Assigned SSO group** by selecting the group and choosing **Unassign** from the **Actions** menu. As a result, the group will lose access to the Amazon DataZone domain. The group’s status will show as **Not Assigned**. Users that gained their access to Amazon DataZone via their membership in this group will lose access. This option is unavailable if the domain is set to implicit user assignment.