AWS organizations documentation change
Summary
Updated terminology from 'disable' to 'turn off/deregister', added Network Flow Monitor integration details, expanded service-linked roles, and revised delegated administrator management processes.
Security assessment
Changes clarify security-related processes (trusted access management, delegated administrator registration/deregistration) and introduce service-linked roles for Network Flow Monitor. While these updates improve security documentation and best practices, there's no evidence they address a specific disclosed vulnerability.
Diff
diff --git a/organizations/latest/userguide/services-that-can-integrate-cloudwatch.md b/organizations/latest/userguide/services-that-can-integrate-cloudwatch.md index 32706fd17..60eb665f3 100644 --- a//organizations/latest/userguide/services-that-can-integrate-cloudwatch.md +++ b//organizations/latest/userguide/services-that-can-integrate-cloudwatch.md @@ -5 +5 @@ -Service-linked rolesService principalsEnable trusted accessDisable trusted accessEnable delegated administratorDisabling a delegated administrator for CloudWatch +Service-linked rolesService principalsEnable trusted accessTurn off trusted accessRegister delegated administratorDeregister a delegated administrator for CloudWatch @@ -9 +9,10 @@ Service-linked rolesService principalsEnable trusted accessDisable trusted acces -You can use Organizations for Amazon CloudWatch to discover and understand the state of telemetry configuration for your AWS resources from a central view in the CloudWatch console. This simplifies the process of auditing your telemetry collection configurations across multiple resource types across your AWS organization or account. +You can use AWS Organizations for Amazon CloudWatch for the following use cases: + + * Discover and understand the state of telemetry configuration for your AWS resources from a central view in the CloudWatch console. This simplifies the process of auditing your telemetry collection configurations for multiple resource types across your AWS organization or account. You must turn on trusted access to use telemetry config across your organization. + +For more information, see [Auditing CloudWatch telemetry configurations](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/telemetry-config-cloudwatch.html) in the _Amazon CloudWatch User Guide_. + + * Work with multiple accounts in Network Flow Monitor, a feature of Amazon CloudWatch Network Monitoring. Network Flow Monitor provides near real-time visibility into network performance for traffic between Amazon EC2 instances. After you turn on trusted access to integrate with Organizations, you can create a monitor to visualize network performance details across multiple accounts. + +For more information, see [ Initialize Network Flow Monitor for multi-account monitoring](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.html) in the _Amazon CloudWatch User Guide_. + @@ -11 +19,0 @@ You can use Organizations for Amazon CloudWatch to discover and understand the s -By integrating with Organizations, you can make modifications to configurations supported by Amazon CloudWatch for Organizations. You must enable trusted access to use telemetry config across your organization. @@ -13 +20,0 @@ By integrating with Organizations, you can make modifications to configurations -For more information, see [Auditing telemetry configurations](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/telemetry-config-cloudwatch.html) in the _Amazon CloudWatch User Guide_. @@ -31,0 +39,4 @@ The service-linked role in the previous section can be assumed only by the servi + * `networkflowmonitor.amazonaws.com` + + * `topology.networkflowmonitor.amazonaws.com` + @@ -37 +48 @@ The service-linked role in the previous section can be assumed only by the servi -For information about the permissions needed to enable trusted access, see [Permissions required to enable trusted access](./orgs_integrate_services.html#orgs_trusted_access_perms). +For information about the permissions that you need to turn on trusted access, see [Permissions required to enable trusted access](./orgs_integrate_services.html#orgs_trusted_access_perms). @@ -47 +58 @@ If you enable trusted access by using the Amazon CloudWatch console or tools the -###### To enable trusted access using the CloudWatch console +###### To turn on trusted access using the CloudWatch console @@ -50,0 +62,2 @@ See [ Turning on CloudWatch telemetry auditing ](https://docs.aws.amazon.com/Ama +When you turn on trusted access in CloudWatch, you enable telemetry auditing and you can work with multiple accounts in Network Flow Monitor. + @@ -94 +107 @@ This command produces no output when successful. -## Disabling trusted access with CloudWatch +## Turn off trusted access with CloudWatch @@ -106 +119 @@ If you disable trusted access by using the Amazon CloudWatch console or tools th -###### To disable trusted access using the CloudWatch console +###### To turn off trusted access using the CloudWatch console @@ -109,0 +123,2 @@ See [ Turning off CloudWatch telemetry auditing ](https://docs.aws.amazon.com/Am +When you turn off trusted access in CloudWatch, telemetry auditing is no longer active and you can no longer work with multiple accounts in Network Flow Monitor. + @@ -133 +148 @@ This command produces no output when successful. -## Enabling a delegated administrator account for CloudWatch +## Registering a delegated administrator account for CloudWatch @@ -135 +150 @@ This command produces no output when successful. -When you designate a member account as a delegated administrator for the organization, users and roles from that account can perform administrative actions for CloudWatch that otherwise can be performed only by users or roles in the organization's management account. This helps you to separate management of the organization from management of CloudWatch. +When you register a member account as a delegated administrator account for the organization, users and roles from that account can perform administrative actions for CloudWatch that otherwise can be performed only by users or roles signed in with the organization's management account. Using a delegated administrator account helps you to separate management of the organization from management of features in CloudWatch. @@ -139 +154 @@ When you designate a member account as a delegated administrator for the organiz -Only an administrator in the Organizations management account can configure a member account as a delegated administrator for CloudWatch in the organization. +Only an administrator in the Organizations management account can register a member account as a delegated administrator account for CloudWatch in the organization. @@ -141 +156 @@ Only an administrator in the Organizations management account can configure a me -You can register a delegated administrator account using the CloudWatch console, or by using the Organizations `RegisterDelegatedAdministrator` CLI or SDK operation. For information on how to register a delegated administrator using the CloudWatch console, see [ Turning on CloudWatch telemetry auditing ](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.html) in the _Amazon CloudWatch ser guide_. +You can register a delegated administrator account using the CloudWatch console, or by using the Organizations `RegisterDelegatedAdministrator` API operation with the AWS Command Line Interface or an SDK. @@ -143 +158,5 @@ You can register a delegated administrator account using the CloudWatch console, -## Disabling a delegated administrator for CloudWatch +For information on how to register a delegated administrator account by using the CloudWatch console, see [ Turning on CloudWatch telemetry auditing ](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.html) in the _Amazon CloudWatch User Guide_. + +When you register a delegated administrator account in CloudWatch, you can use the account for management operations with telemetry auditing and with Network Flow Monitor. + +## Deregister a delegated administrator for CloudWatch @@ -147 +166,3 @@ You can register a delegated administrator account using the CloudWatch console, -Only an administrator in the Organizations management account can remove a delegated administrator for CloudWatch in the organization. +Only an administrator signed in with the Organizations management account can deregister a delegated administrator account for CloudWatch in the organization. + +You can deregister the delegated administrator account by using either the CloudWatch console, or by using the Organizations `DeregisterDelegatedAdministrator` API operation with the AWS Command Line Interface or an SDK. For more information, see [ Deregistering a delegated administrator account](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.html#telemetry-config-deregister-administrator) in the _Amazon CloudWatch User Guide_. @@ -149 +170 @@ Only an administrator in the Organizations management account can remove a deleg -You can remove the delegated administrator using either the CloudWatch console, or by using the Organizations `DeregisterDelegatedAdministrator` CLI or SDK operation. For more information see [ Turning off CloudWatch telemetry auditing ](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/telemetry-config-turn-off.html) in the _Amazon CloudWatch User Guide_. +When you deregister a delegated administrator account in CloudWatch, you can no longer use the account for management operations with telemetry auditing and with Network Flow Monitor.