AWS AWSEC2 documentation change
Summary
Expanded EC2FastLaunchFullAccess policy permissions to include Create/Modify Launch Template operations, network/SG resource management, and CloudFormation stack operations. Added EC2FastLaunchServiceRolePolicy permissions for EventBridge, CloudFormation, License Manager, KMS grants, and launch template deletion.
Security assessment
The changes document expanded IAM policy permissions for EC2 Fast Launch features. While they involve security-sensitive actions like managing security groups, KMS grants, and network resources, there's no evidence these changes address a specific vulnerability. The updates appear to reflect new feature capabilities rather than patching security flaws.
Diff
diff --git a/AWSEC2/latest/UserGuide/security-iam-awsmanpol.md b/AWSEC2/latest/UserGuide/security-iam-awsmanpol.md index 46e3a7bcc..465b3a25d 100644 --- a//AWSEC2/latest/UserGuide/security-iam-awsmanpol.md +++ b//AWSEC2/latest/UserGuide/security-iam-awsmanpol.md @@ -71 +71 @@ You can attach the `EC2FastLaunchFullAccess` policy to your instance profile or - * **Amazon EC2** – Access is granted for Amazon EC2 RunInstances, CreateTags and Describe actions that are needed to verify resource permissions. + * **Amazon EC2** – Access is granted for Amazon EC2 RunInstances, CreateTags, Describe, and Create and Modify Launch Template operations. Access is also granted to create network and security group resources, authorize ingress rules, and delete resources that EC2 Fast Launch created. @@ -74,0 +75,2 @@ You can attach the `EC2FastLaunchFullAccess` policy to your instance profile or + * **AWS CloudFormation** – Access is granted for EC2 Fast Launch to describe and create CloudFormation stacks, and to delete stacks that it created. + @@ -97,0 +100,2 @@ Change | Description | Date +EC2FastLaunchFullAccess – Updated policy | Amazon EC2 updated this policy to include Create and Modify Launch Template operations, to create network and security group resources, authorize ingress rules, and delete resources that EC2 Fast Launch created. It can additionally describe and create CloudFormation stacks, and delete stacks that EC2 Fast Launch created. | May 14, 2025 +EC2FastLaunchServiceRolePolicy – Updated policy | Amazon EC2 updated this policy to add Amazon EventBridge access to create and manage event rules for EC2 Fast Launch. Additionally, EC2 Fast Launch can now describe AWS CloudFormation stacks, launch an instance from an AMI that's associated with AWS License Manager, get a list of AWS KMS grants it created that can be retired, and delete launch templates that it created. | May 14, 2025