AWS prometheus documentation change
Summary
Updated IAM policy permissions to include query logging configuration actions
Security assessment
Added permissions for query logging configuration management relate to audit capabilities rather than addressing a specific vulnerability. This enhances security documentation by describing monitoring controls but doesn't fix a known security issue.
Diff
diff --git a/prometheus/latest/userguide/doc-history.md b/prometheus/latest/userguide/doc-history.md index 5a1a6e816..0ad3d6179 100644 --- a//prometheus/latest/userguide/doc-history.md +++ b//prometheus/latest/userguide/doc-history.md @@ -11 +11 @@ Change| Description| Date -[Update to the AmazonPrometheusConsoleFullAccess managed IAM policy. ](https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam-awsmanpol.html#AmazonPrometheusConsoleFullAccess)| The [AmazonPrometheusConsoleFullAccess](https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam-awsmanpol.html#AmazonPrometheusConsoleFullAccess) policy was updated. The `aps:UpdateWorkspaceConfiguration` and `aps:DescribeWorkspaceConfiguration` permissions were added to the policy.| April 14, 2025 +[Update to the AmazonPrometheusConsoleFullAccess managed IAM policy. ](https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam-awsmanpol.html#AmazonPrometheusConsoleFullAccess)| The [AmazonPrometheusConsoleFullAccess](https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam-awsmanpol.html#AmazonPrometheusConsoleFullAccess) policy was updated. The `aps:CreateQueryLoggingConfiguration`, `aps:UpdateQueryLoggingConfiguration`, `aps:DeleteQueryLoggingConfiguration`, `aps:DescribeQueryLoggingConfiguration` permissions were added to the policy.| May 5, 2025