AWS cloudshell medium security documentation change

Service: cloudshell · 2025-05-22 · Security-related medium

File: cloudshell/latest/userguide/aws-cloudshell-vpc-permissions-1.md

Summary

Added 'aws:CalledVia': 'cloudshell.amazonaws.com' conditions to IAM policy statements

Security assessment

The changes enforce stricter IAM policies by restricting actions to only those called via CloudShell, reducing the risk of unintended access. This is a security improvement with explicit conditions added to permissions.

Diff

diff --git a/cloudshell/latest/userguide/aws-cloudshell-vpc-permissions-1.md b/cloudshell/latest/userguide/aws-cloudshell-vpc-permissions-1.md
index 7efc0ccfe..3fd9d78ff 100644
--- a//cloudshell/latest/userguide/aws-cloudshell-vpc-permissions-1.md
+++ b//cloudshell/latest/userguide/aws-cloudshell-vpc-permissions-1.md
@@ -66,2 +65,0 @@ The following example displays how to enable full permissions, including access
-            "ec2:DescribeDhcpOptions",
-            "ec2:DescribeNetworkInterfaces",
@@ -75 +73,15 @@ The following example displays how to enable full permissions, including access
-          "Sid": "AllowCreateTagWithCloudShellKey",
+    			"Sid": "AllowInspectVPCConfigurationViaCloudShell",
+    			"Effect": "Allow",
+    			"Action": [
+    				"ec2:DescribeDhcpOptions",
+    				"ec2:DescribeNetworkInterfaces"
+    			],
+    			"Resource": "*",
+    			"Condition": {
+    				"ForAnyValue:StringEquals": {
+    					"aws:CalledVia": "cloudshell.amazonaws.com"
+    				}
+    			}
+    		},
+    		{
+    			"Sid": "AllowCreateTagWithCloudShellKeyViaCloudShell",
@@ -86 +98,2 @@ The following example displays how to enable full permissions, including access
-              "aws:TagKeys": "ManagedByCloudShell"
+    					"aws:TagKeys": "ManagedByCloudShell",
+    					"aws:CalledVia": "cloudshell.amazonaws.com"
@@ -91 +104 @@ The following example displays how to enable full permissions, including access
-          "Sid": "AllowCreateNetworkInterfaceWithSubnetsAndSG",
+    			"Sid": "AllowCreateNetworkInterfaceWithSubnetsAndSGViaCloudShell",
@@ -99 +112,6 @@ The following example displays how to enable full permissions, including access
-          ]
+    			],
+    			"Condition": {
+    				"ForAnyValue:StringEquals": {
+    					"aws:CalledVia": "cloudshell.amazonaws.com"
+    				}
+    			}
@@ -102 +120 @@ The following example displays how to enable full permissions, including access
-          "Sid": "AllowCreateNetworkInterfaceWithCloudShellTag",
+    			"Sid": "AllowCreateNetworkInterfaceWithCloudShellTagViaCloudShell",
@@ -110 +128,2 @@ The following example displays how to enable full permissions, including access
-              "aws:TagKeys": "ManagedByCloudShell"
+    					"aws:TagKeys": "ManagedByCloudShell",
+    					"aws:CalledVia": "cloudshell.amazonaws.com"
@@ -115 +134 @@ The following example displays how to enable full permissions, including access
-          "Sid": "AllowCreateNetworkInterfacePermissionWithCloudShellTag",
+    			"Sid": "AllowCreateNetworkInterfacePermissionWithCloudShellTagViaCloudShell",
@@ -123,0 +143,3 @@ The following example displays how to enable full permissions, including access
+    				},
+    				"ForAnyValue:StringEquals": {
+    					"aws:CalledVia": "cloudshell.amazonaws.com"
@@ -128 +150 @@ The following example displays how to enable full permissions, including access
-          "Sid": "AllowDeleteNetworkInterfaceWithCloudShellTag",
+    			"Sid": "AllowDeleteNetworkInterfaceWithCloudShellTagViaCloudShell",
@@ -136,0 +159,3 @@ The following example displays how to enable full permissions, including access
+    				},
+    				"ForAnyValue:StringEquals": {
+    					"aws:CalledVia": "cloudshell.amazonaws.com"