AWS elasticbeanstalk documentation change
Summary
Simplified IAM role creation steps for EC2 instance profiles, removed redundant navigation details, and streamlined policy attachment instructions
Security assessment
The changes improve documentation for configuring IAM roles (a security feature), but do not address a specific vulnerability. Updates clarify security best practices for instance profiles without evidence of mitigating an active threat.
Diff
diff --git a/elasticbeanstalk/latest/dg/environments-create-wizard.md b/elasticbeanstalk/latest/dg/environments-create-wizard.md index 47c519796..a96003008 100644 --- a//elasticbeanstalk/latest/dg/environments-create-wizard.md +++ b//elasticbeanstalk/latest/dg/environments-create-wizard.md @@ -195 +195 @@ For more information about load balancer types and settings, see [Load balancer -The Classic Load Balancer (CLB) option is disabled on the **Create Environment** console wizard. If you have an existing environment configured with a Classic Load Balancer you can create a new one by [cloning the existing environment](./using-features.managing.clone.html) using either the Elastic Beanstalk console or the [EB CLI](./using-features.managing.clone.html#using-features.managing.clone.CLI). You also have the option to use the [EB CLI](./eb-cli3-getting-started.html) or the [AWS CLI](./environments-create-awscli.html) to create a new environment configured with a Classic Load Balancer. These command line tools will create a new environment with a CLB even if one doesn’t already exist in your account. +The Classic Load Balancer (CLB) option is disabled on the **Create Environment** console wizard. If you have an existing environment configured with a Classic Load Balancer you can create a new one by [cloning the existing environment](./using-features.managing.clone.html) using either the Elastic Beanstalk console or the [EB CLI](./using-features.managing.clone.html#using-features.managing.clone.CLI). You also have the option to use the EB CLI or the [AWS CLI](./environments-create-awscli.html) to create a new environment configured with a Classic Load Balancer. These command line tools will create a new environment with a CLB even if one doesn’t already exist in your account. @@ -217 +217 @@ The first time you create an environment in the Elastic Beanstalk console, you m -###### To create an IAM Role for EC2 instance profile selection +###### To create the EC2 instance profile @@ -219 +219 @@ The first time you create an environment in the Elastic Beanstalk console, you m - 1. Choose **View permission details**. This displays under the **EC2 instance profile** dropdown list. + 1. Choose **Create role**. @@ -221 +221 @@ The first time you create an environment in the Elastic Beanstalk console, you m -A modal window titled **View instance profile permissions** displays. This window lists the managed profiles that you'll need to attach to the new EC2 instance profile that you create. It also provides a link to launch the IAM console. + 2. For **Trusted entity type** , choose **AWS service**. @@ -223 +223 @@ A modal window titled **View instance profile permissions** displays. This windo - 2. Choose the **IAM console** link displayed at the top of the window. + 3. For **Use case** , choose**Elastic Beanstalk – Compute**. @@ -225 +225 @@ A modal window titled **View instance profile permissions** displays. This windo - 3. In the IAM console navigation pane, choose **Roles**. + 4. Choose **Next**. @@ -227,9 +227 @@ A modal window titled **View instance profile permissions** displays. This windo - 4. Choose **Create role**. - - 5. Under **Trusted entity type** , choose **AWS service**. - - 6. Under **Use case** , choose **EC2**. - - 7. Choose **Next**. - - 8. Attach the appropriate managed policies. Scroll in the **View instance profile permissions** modal window to see the managed policies. The policies are also listed here: + 5. Verify that **Permissions policies** include the following, then choose **Next** : @@ -243,17 +235 @@ A modal window titled **View instance profile permissions** displays. This windo - 9. Choose **Next**. - - 10. Enter a name for the role. - - 11. (Optional) Add tags to the role. - - 12. Choose **Create role**. - - 13. Return to the Elastic Beanstalk console window that is open. - - 14. Close the modal window **View instance profile permissions**. - -###### Important - -Do not close the browser page that displays the Elastic Beanstalk console. - - 15. Choose  (refresh), next to the **EC2 instance profile** dropdown list. + 6. Choose **Create role**. @@ -261 +237 @@ Do not close the browser page that displays the Elastic Beanstalk console. -This refreshes the dropdown list, so that the Role you just created will display in the dropdown list. + 7. Return to the **Configure service access** tab, refresh the list, then select the newly created EC2 instance profile.