AWS elasticbeanstalk documentation change
Summary
Added sections on managed policies and creating EC2 instance profiles, with expanded guidance on attaching policies and creating profiles via IAM
Security assessment
The changes clarify IAM role and policy management for EC2 instance profiles, which are security-related features. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/elasticbeanstalk/latest/dg/concepts-roles-instance.md b/elasticbeanstalk/latest/dg/concepts-roles-instance.md index 6af6103a8..3a36df158 100644 --- a//elasticbeanstalk/latest/dg/concepts-roles-instance.md +++ b//elasticbeanstalk/latest/dg/concepts-roles-instance.md @@ -4,0 +5,2 @@ +Managed policiesCreating an EC2 instance profile + @@ -25,0 +28,2 @@ An instance profile is an IAM role that's applied to Amazon EC2 instances that a +## Managed policies + @@ -37 +41,3 @@ Elastic Beanstalk provides a set of managed policies that allow the EC2 instance -You attach these policies to the instance profile that you create when you launch an environment in the Elastic Beanstalk console for the first time. +If your web application requires access to other additional AWS services, add statements or managed policies to the instance profile that allow access to those services. For more information, see [Adding permissions to the default instance profile](./iam-instanceprofile.html#iam-instanceprofile-addperms). + +## Creating an EC2 instance profile @@ -39 +45 @@ You attach these policies to the instance profile that you create when you launc -If your web application requires access to other additional AWS services, add statements or managed policies to the instance profile that allow access to those services. +If your AWS account doesn’t have an EC2 instance profile, you must create one using the IAM service. You can then assign the EC2 instance profile to new environments that you create. The **Create environment** steps in the Elastic Beanstalk console provides you access to the IAM console, so that you can create an EC2 instance profile with the required permissions. @@ -41 +47 @@ If your web application requires access to other additional AWS services, add st -For more information about instance profiles, see [Managing Elastic Beanstalk instance profiles](./iam-instanceprofile.html). +You can also create an EC2 instance profile by directly accessing the IAM console, without going through the Elastic Beanstalk console. For detailed steps to create an Elastic Beanstalk EC2 instance profile in the IAM console, see [Creating an instance profile](./iam-instanceprofile.html#iam-instanceprofile-create).