AWS managedservices documentation change
Summary
Added documentation for new IAM roles/policies (customer_ecr_poweruser_instance_profile) and updated title/headers
Security assessment
Documents additional IAM roles/policies that enforce least privilege access patterns for ECR operations, though not tied to a specific security issue
Diff
diff --git a/managedservices/latest/userguide/ecr.md b/managedservices/latest/userguide/ecr.md index 74e6986ed..af5bb3bc3 100644 --- a//managedservices/latest/userguide/ecr.md +++ b//managedservices/latest/userguide/ecr.md @@ -5 +5 @@ -Amazon Elastic Container Registry in AWS Managed Services FAQs +Amazon Elastic Container Registry in AWS Managed Services FAQ @@ -13 +13 @@ To learn more, see [Amazon Elastic Container Registry](https://aws.amazon.com/ec -## Amazon Elastic Container Registry in AWS Managed Services FAQs +## Amazon Elastic Container Registry in AWS Managed Services FAQ @@ -17 +17 @@ To learn more, see [Amazon Elastic Container Registry](https://aws.amazon.com/ec -Request access to Amazon ECR by submitting an RFC with the Management | AWS service | Self-provisioned service | Add (ct-1w8z66n899dct) change type. This RFC provisions the following IAM role to your account: ` customer_ecr_console_role`. Once provisioned in your account, you must onboard the role in your federation solution. +Request access to Amazon ECR by submitting an RFC with the Management | AWS service | Self-provisioned service | Add (ct-1w8z66n899dct) change type. This RFC provisions the following IAM roles to your account: ` customer_ecr_console_role`, and `customer_ecr_poweruser_instance_profile` with associated IAM policies, `customer_ecr_console_policy` and `customer_ecr_poweruser_instance_profile_policy`, respectively. Once provisioned in your account, you must onboard the role in your federation solution. @@ -27,4 +26,0 @@ There are no prerequisites or dependencies to use Amazon ECR in your AMS account -**Q: Is it possible to have an instance profile with Amazon ECR power user permissions?** - -Yes, use change type Management | Applications | IAM instance profile | Create (ct-0ixp4ch2tiu04). -