AWS awscloudtrail medium security documentation change
Summary
Clarified service-linked role creation conditions and added details about AWSServiceRoleForCloudTrailEventContext
Security assessment
Explains security-critical IAM role creation behavior differences between CLI/API operations and console usage, specifically detailing when AWSServiceRoleForCloudTrail and AWSServiceRoleForCloudTrailEventContext are created. This impacts understanding of least privilege implementation for organization trails.
Diff
diff --git a/awscloudtrail/latest/userguide/security_iam_troubleshoot.md b/awscloudtrail/latest/userguide/security_iam_troubleshoot.md index dcd870ea1..f91f6a138 100644 --- a//awscloudtrail/latest/userguide/security_iam_troubleshoot.md +++ b//awscloudtrail/latest/userguide/security_iam_troubleshoot.md @@ -103 +103 @@ If you need help, contact your AWS administrator. Your administrator is the pers -The `NoManagementAccountSLRExistsException` exception is thrown when the management account does not have a service-linked role. When you add a delegated administrator using the AWS Organizations AWS CLI or API operation, the service-linked role doesn't get created if it does not exist. +The `NoManagementAccountSLRExistsException` exception is thrown when the management account does not have a service-linked role. @@ -105 +105,5 @@ The `NoManagementAccountSLRExistsException` exception is thrown when the managem -When you use your organization's management account to add a delegated administrator or create an organization trail or event data store in the CloudTrail console, or by using the AWS CLI or CloudTrail API, CloudTrail automatically creates a service-linked role for your management account if one does not already exist. +When you add a delegated administrator using the AWS Organizations CLI or API operation, CloudTrail service-linked roles won't be created automatically if they don't exist. The service-linked roles are only created when you make a call from the management account directly to the CloudTrail service. For example, when you add a delegated administrator or create an organization trail or event data store using the CloudTrail console, AWS CLI or CloudTrail API, the AWSServiceRoleForCloudTrail service-linked role is created. + +When you add a delegated administrator using the AWS CloudTrail; CLI or API operation, CloudTrail will create both the AWSServiceRoleForCloudTrail and the AWSServiceRoleForCloudTrailEventContext service-linked roles. + +When you use your organization's management account to add a delegated administrator or create an organization trail or event data store in the CloudTrail console, or by using the AWS CLI or CloudTrail API, CloudTrail automatically creates the AWSServiceRoleForCloudTrail service-linked role for your management account if it does not already exist. For more information, see [Using service-linked roles for CloudTrail](./using-service-linked-roles.html).