AWS cloud9 documentation change
Summary
Updated IAM policies with SSM connection checks and removed deprecated API permissions
Security assessment
Policy changes focus on maintaining current functionality (adding ssm:GetConnectionStatus, removing deprecated ValidateEnvironmentName) without explicit security vulnerability remediation
Diff
diff --git a/cloud9/latest/user-guide/security-iam.md b/cloud9/latest/user-guide/security-iam.md index 0747b8b91..c6b9f79ef 100644 --- a//cloud9/latest/user-guide/security-iam.md +++ b//cloud9/latest/user-guide/security-iam.md @@ -686 +685,0 @@ This policy includes the following permissions. - "cloud9:GetMigrationExperiences", @@ -788 +787 @@ This policy includes the following permissions: - * IAM – Get information about IAM users in their AWS account. + * IAM – Get information about IAM users in their AWS account, and create the AWS Cloud9 service-linked role in their AWS account as needed. @@ -804 +802,0 @@ This policy includes the following permissions: - "cloud9:GetMigrationExperiences", @@ -973,4 +971,3 @@ Change | Description | Date -AWSCloud9User – ChangeAWSCloud9EnvironmentMember – Change | AWS Cloud9 added `cloud9:GetMigrationExperiences` action that allows you to access and view new migration experiences. | January 27, 2025 -AWSCloud9User – ChangeAWSCloud9Administrator – ChangeAWSCloud9EnvironmentMember– Change | AWS Cloud9 added `ssm:GetConnectionStatus` action to grant permissions to check the SSM connection status.The`cloud9:ValidateEnvironmentName` API is removed from the AWSCloud9User policy as it is deprecated. | October 12, 2023 -AWSCloud9User – ChangeAWSCloud9Administrator – Change | AWS Cloud9 added `ec2:DescribeInstanceTypeOfferings` and `ec2:DescribeRouteTables` actions. These policies allow AWS Cloud9 to validate the default subnet that supports the instance type chosen by the customer when they are creating an AWS Cloud9 environment. | August 02, 2023 -AWSCloud9ServiceRolePolicy – Change | AWS Cloud9 updated the `AWSCloud9ServiceRolePolicy` to allow AWS Cloud9 to start and stop Amazon EC2 instances that are managed by License Manager license configurations. | January 12, 2022 +A new action has been added to **AWSCloud9User** , **AWSCloud9Administrator** and **AWSCloud9EnvironmentMember** policies. | The `ssm:GetConnectionStatus` action has been added to **AWSCloud9User** **AWSCloud9Administrator** and **AWSCloud9EnvironmentMember** policies. This action will grant users the permissions to check the SSM connection status. The `cloud9:ValidateEnvironmentName` API has been removed from the **AWSCloud9User** policy as it is deprecated. | October 12, 2023 +API's added to **AWSCloud9User** and **AWSCloud9Administrator** policies. | Two new API's have been added to the **AWSCloud9User** and **AWSCloud9Administrator** policies, these API's are `ec2:DescribeInstanceTypeOfferings` and `ec2:DescribeRouteTables`. The purpose of these API's is to enable AWS Cloud9 to validate that the default subnet supports the instance type chosen by the customer when they are creating a AWS Cloud9 environment. | August 02, 2023 +Update to AWSCloud9ServiceRolePolicy | AWSCloud9ServiceRolePolicy was updated to allow AWS Cloud9 to start and stop Amazon EC2 instances that are managed by License Manager license configurations. | January 12, 2022