AWS aurora-dsql medium security documentation change
Summary
Updated IAM policy examples with granular actions and explicit resource ARNs
Security assessment
The policy changes enforce least privilege by replacing broad actions (e.g., CreateMultiRegionClusters) with specific API operations (dsql:PutWitnessRegion) and explicit resource constraints. This directly addresses potential over-permissioning security risks.
Diff
diff --git a/aurora-dsql/latest/userguide/using-iam-condition-keys.md b/aurora-dsql/latest/userguide/using-iam-condition-keys.md index 6bb11fba7..a1b9f3e49 100644 --- a//aurora-dsql/latest/userguide/using-iam-condition-keys.md +++ b//aurora-dsql/latest/userguide/using-iam-condition-keys.md @@ -7,2 +6,0 @@ Create a cluster in a specific RegionCreate a multi-Region cluster in specific R -Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas and Previews ](https://aws.amazon.com/service-terms/) in the AWS Service Terms. - @@ -35 +33 @@ The following policy grants permission to create clusters in the US East (N. Vir -The following policy grants permission to create multi-Region clusters in the US East (N. Virginia) and US East (Ohio) Regions. This policy uses the resource ARN to limit the allowed Regions, so Aurora DSQL can only create multi-Region clusters only if that ARN is specified in the `Resource` section of the policy. Note that creating multi-Region clusters also requires `CreateCluster` permission in each specified Region. +The following policy grants permission to create multi-Region clusters in the US East (N. Virginia) and US East (Ohio) Regions. This policy uses the resource ARN to limit the allowed Regions, so Aurora DSQL can create multi-Region clusters only if this ARN is specified in the `Resource` section of the policy. Note that creating multi-Region clusters also requires the `PutMultiRegionProperties`, `PutWitnessRegion`, and `AddPeerCluster` permissions in each specified Region. @@ -42,5 +40,6 @@ The following policy grants permission to create multi-Region clusters in the US - - "Action": ["CreateMultiRegionClusters"], - "Resource": [ - "arn:aws:dsql:us-east-1:*:cluster/*", - "arn:aws:dsql:us-east-2:*:cluster/*" + "Effect": "Allow", + "Action": [ + "dsql:CreateCluster", + "dsql:PutMultiRegionProperties", + "dsql:PutWitnessRegion", + "dsql:AddPeerCluster" @@ -48,4 +46,0 @@ The following policy grants permission to create multi-Region clusters in the US - "Effect": "Allow" - }, - { - "Action": ["CreateCluster"], @@ -53,4 +48,3 @@ The following policy grants permission to create multi-Region clusters in the US - "arn:aws:dsql:us-east-1:*:cluster/*", - "arn:aws:dsql:us-east-2:*:cluster/*" - ], - "Effect": "Allow" + "arn:aws:dsql:us-east-1:123456789012:cluster/*", + "arn:aws:dsql:us-east-2:123456789012:cluster/*" + ] @@ -70,2 +63,0 @@ The following policy uses an Aurora DSQL `dsql:WitnessRegion` condition key and - "Action": ["CreateMultiRegionClusters"], - "Resource": "*", @@ -72,0 +65,13 @@ The following policy uses an Aurora DSQL `dsql:WitnessRegion` condition key and + "Action": [ + "dsql:CreateCluster", + "dsql:PutMultiRegionProperties", + "dsql:AddPeerCluster" + ], + "Resource": "arn:aws:dsql:*:123456789012:cluster/*" + }, + { + "Effect": "Allow", + "Action": [ + "dsql:PutWitnessRegion" + ] + "Resource": "arn:aws:dsql:*:123456789012:cluster/*", @@ -75 +80,3 @@ The following policy uses an Aurora DSQL `dsql:WitnessRegion` condition key and - "dsql:WitnessRegion": ["us-west-2"] + "dsql:WitnessRegion": [ + "us-west-2" + ] @@ -78,5 +85,0 @@ The following policy uses an Aurora DSQL `dsql:WitnessRegion` condition key and - }, - { - "Action": ["CreateCluster"], - "Resource": "*", - "Effect": "Allow"