AWS awscloudtrail documentation change
Summary
Clarified service-linked role creation behavior and added reference to AWSServiceRoleForCloudTrailEventContext
Security assessment
Improves documentation accuracy about role management but doesn't introduce new security controls or address vulnerabilities
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.md b/awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.md index a6d6b92eb..af611aa7e 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.md +++ b//awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.md @@ -11 +11 @@ If you choose a delegated administrator, this member account has administrative -The first time you add a delegated administrator in the CloudTrail console, or by using the AWS CLI or CloudTrail API, CloudTrail checks whether the organization’s management account has a service-linked role. If the management account does not have a service-linked role, CloudTrail creates the service-linked role for the management account. For more information about service-linked roles, see [Using service-linked roles for AWS CloudTrail](./using-service-linked-roles.html). +The first time you add a delegated administrator in the CloudTrail console, or by using the AWS CLI or CloudTrail API, CloudTrail checks whether the organization’s management account has a service-linked role. If the management account does not have a service-linked role, CloudTrail creates the service-linked role for the management account. For more information about service-linked roles, see [Using service-linked roles for CloudTrail](./using-service-linked-roles.html). @@ -15 +15,3 @@ The first time you add a delegated administrator in the CloudTrail console, or b -When you add a delegated administrator using the AWS Organizations CLI or API operation, the service-linked role doesn't get created if it does not exist. The service-linked role is only created when you make a call from the management account directly to the CloudTrail service, such as when you add a delegated administrator or create an organization trail or event data store using the CloudTrail console, AWS CLI or CloudTrail API. +When you add a delegated administrator using the AWS Organizations CLI or API operation, CloudTrail service-linked roles won't be created automatically if they don't exist. The service-linked roles are only created when you make a call from the management account directly to the CloudTrail service. For example, when you add a delegated administrator or create an organization trail or event data store using the CloudTrail console, AWS CLI or CloudTrail API, the AWSServiceRoleForCloudTrail service-linked role is created. + +When you add a delegated administrator using the AWS CloudTrail; CLI or API operation, CloudTrail will create both the AWSServiceRoleForCloudTrail and the AWSServiceRoleForCloudTrailEventContext service-linked roles. For more information, see [Using service-linked roles for CloudTrail](./using-service-linked-roles.html)..