AWS AWSEC2 documentation change
Summary
Reorganized IAM policy documentation by grouping permissions under service categories and adding detailed explanations of EC2 Fast Launch operations
Security assessment
The changes restructure permission documentation to better explain service interactions and security controls (including KMS encryption, IAM roles, and resource management), but there's no evidence of addressing a specific security vulnerability. The updates improve clarity about security-related permissions without indicating a resolved security issue.
Diff
diff --git a/AWSEC2/latest/UserGuide/slr-windows-fast-launch.md b/AWSEC2/latest/UserGuide/slr-windows-fast-launch.md index 7a378fcd2..547ebccda 100644 --- a//AWSEC2/latest/UserGuide/slr-windows-fast-launch.md +++ b//AWSEC2/latest/UserGuide/slr-windows-fast-launch.md @@ -24 +24 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `cloudwatch:PutMetricData` – Post metric data associated with EC2 Fast Launch to the Amazon EC2 namespace. + * **AWS CloudFormation** – Allow EC2 Fast Launch to get a description of associated CloudFormation stacks. @@ -26 +26 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:CreateLaunchTemplate` – Create a launch template for your Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled. + * **Amazon CloudWatch** – Post metric data associated with EC2 Fast Launch to the Amazon EC2 namespace. @@ -28 +28 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:CreateSnapshot` – Create pre-provisioned snapshots for your Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled. + * **Amazon EC2** – Access is granted for EC2 Fast Launch to perform the following actions: @@ -30 +30 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:CreateTags` – Create tags for resources that are associated with launching and pre-provisioning Windows instances for your Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled. + * Launch instances from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled, in order to perform provisioning steps. Additionally specify resource pattern that allows `ec2:RunInstances` for an AMI that's associated with License Manager. @@ -32 +32 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DeleteSnapshots` – Delete all associated pre-provisioned snapshots if EC2 Fast Launch is turned off for a previously enabled AMI. + * Stop and terminate an instance that was launched by EC2 Fast Launch after it creates the pre-provisioned snapshot. @@ -34 +34 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeImages` – Describe images for all resources. + * Describe image and instance type resources used to launch instances from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled and create snapshots from them. @@ -36 +36 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeInstanceAttribute` – Describe instance attributes for all resources. + * Describe launch template resources and launch instances from a launch template. @@ -38 +38 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeInstanceStatus` – Describe instance status for all resources. + * Describe instances, instance attributes and instance status @@ -40 +40 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeInstances` – Describe instances for all resources. + * Delete resources that EC2 Fast Launch created, including snapshots and launch templates. @@ -42 +42 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeInstanceTypeOfferings` – Describe instance type offerings for all resources. + * Tag resources that EC2 Fast Launch creates to launch and pre-provision, Windows instances, and create snapshots for the final launch process to consume. @@ -44 +44 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeLaunchTemplates` – Describe launch templates for all resources. + * **Amazon EventBridge** – Includes access to create EventBridge event rules and retrieve details about or delete rules that it created. EC2 Fast Launch may also get a list of target services that receive EC2 Fast Launch events that are forwarded based on event rules, and add target services to or remove them from event rules that it created. @@ -46 +46 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeLaunchTemplateVersions` – Describe launch template versions for all resources. + * **IAM** – Allows EC2 Fast Launch to create the `EC2FastLaunchServiceRolePolicy` service-linked role, to get and use instance profiles whose name contains `ec2fastlaunch`, and to launch instances on your behalf using the instance profile from your launch template. @@ -48 +48 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeSnapshots` – Describe snapshot resources for all resources. + * **AWS KMS** – Includes access to create grants and list grants that were created by EC2 Fast Launch that can be retired. Also to describe or use keys for the purpose of encrypting or decrypting volumes attached to instances that EC2 Fast Launch creates, and to generate data keys that are not plaintext. @@ -50,9 +49,0 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com - * `ec2:DescribeSubnets` – Describe subnets for all resources. - - * `ec2:RunInstances` – Launch instances from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled, in order to perform provisioning steps. - - * `ec2:StopInstances` – Stop instances that were launched from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled, in order to create pre-provisioned snapshots. - - * `ec2:TerminateInstances` – Terminate an instance that was launched from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled, after creating the pre-provisioned snapshot from it. - - * `iam:PassRole` – Allows the AWSServiceRoleForEC2FastLaunch service-linked role to launch instances on your behalf using the instance profile from your launch template. @@ -61,0 +53 @@ Amazon EC2 uses the [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com +To view the permissions for this policy, see [EC2FastLaunchServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchServiceRolePolicy.html) in the _AWS Managed Policy Reference_. @@ -103 +95 @@ Monitor EC2 Fast Launch -Change the Windows Administrator password +Troubleshoot EC2 Fast Launch