AWS dms documentation change

Service: dms · 2025-06-10 · Documentation medium

File: dms/latest/userguide/security-iam-awsmanpol.md

Summary

Added new AmazonDMSRedshiftS3Role policy with S3 bucket management permissions for DMS

Security assessment

Documents new IAM policy granting extensive S3 permissions (create/delete buckets, modify policies) for Redshift integration. While security-relevant, this appears to be new feature support rather than addressing a vulnerability.

Diff

diff --git a/dms/latest/userguide/security-iam-awsmanpol.md b/dms/latest/userguide/security-iam-awsmanpol.md
index d82d1c1ba..4afa09b05 100644
--- a//dms/latest/userguide/security-iam-awsmanpol.md
+++ b//dms/latest/userguide/security-iam-awsmanpol.md
@@ -5 +5 @@
-AmazonDMSVPCManagementRoleAWSDMSServerlessServiceRolePolicyAmazonDMSCloudWatchLogsRoleAWSDMSFleetAdvisorServiceRolePolicyPolicy updates
+AmazonDMSVPCManagementRoleAWSDMSServerlessServiceRolePolicyAmazonDMSCloudWatchLogsRoleAWSDMSFleetAdvisorServiceRolePolicyAmazonDMSRedshiftS3RolePolicy updates
@@ -18,0 +19,2 @@ AmazonDMSVPCManagementRoleAWSDMSServerlessServiceRolePolicyAmazonDMSCloudWatchLo
+  * AWS managed policy: AmazonDMSRedshiftS3Role
+
@@ -317,0 +320,76 @@ This policy includes the following permissions.
+## AWS managed policy: AmazonDMSRedshiftS3Role
+
+This policy provides permissions that allow AWS DMS to manage S3 settings for Redshift endpoints.
+
+**Permissions details**
+
+This policy includes the following operations:
+
+  * `s3:CreateBucket` \- Allows DMS to create S3 buckets with the "dms-" prefix
+
+  * `s3:ListBucket` \- Allows DMS to list the contents of S3 buckets with the "dms-" prefix
+
+  * `s3:DeleteBucket `\- Allows DMS to delete S3 buckets with the "dms-" prefix
+
+  * `s3:GetBucketLocation` \- Allows DMS to retrieve the Region where an S3 bucket is located
+
+  * `s3:GetObject` \- Allows DMS to retrieve objects from S3 buckets with the "dms-" prefix
+
+  * `s3:PutObject` \- Allows DMS to add objects to S3 buckets with the "dms-" prefix
+
+  * `s3:DeleteObject` \- Allows DMS to delete objects from S3 buckets with the "dms-" prefix
+
+  * `s3:GetObjectVersion` \- Allows DMS to retrieve specific versions of objects in versioned buckets
+
+  * `s3:GetBucketPolicy` \- Allows DMS to retrieve bucket policies
+
+  * `s3:PutBucketPolicy` \- Allows DMS to create or update bucket policies
+
+  * `s3:GetBucketAcl` \- Allows DMS to retrieve bucket access control lists (ACLs)
+
+  * `s3:PutBucketVersioning` \- Allows DMS to enable or suspend versioning on buckets
+
+  * `s3:GetBucketVersioning` \- Allows DMS to retrieve the versioning status of buckets
+
+  * `s3:PutLifecycleConfiguration` \- Allows DMS to create or update lifecycle rules for buckets
+
+  * `s3:GetLifecycleConfiguration` \- Allows DMS to retrieve lifecycle rules configured for buckets
+
+  * `s3:DeleteBucketPolicy` \- Allows DMS to delete bucket policies
+
+
+
+
+All these permissions apply only to resources with ARN pattern: `arn:aws:s3:::dms-*`
+
+**JSON policy document**
+    
+    
+    {
+      "Version": "2012-10-17", 
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:CreateBucket",
+            "s3:ListBucket", 
+            "s3:DeleteBucket",
+            "s3:GetBucketLocation",
+            "s3:GetObject",
+            "s3:PutObject",
+            "s3:DeleteObject",
+            "s3:GetObjectVersion",
+            "s3:GetBucketPolicy",
+            "s3:PutBucketPolicy",
+            "s3:GetBucketAcl",
+            "s3:PutBucketVersioning",
+            "s3:GetBucketVersioning",
+            "s3:PutLifecycleConfiguration",
+            "s3:GetLifecycleConfiguration",
+            "s3:DeleteBucketPolicy"
+          ],
+          "Resource": "arn:aws:s3:::dms-*"
+        }
+      ]
+    }
+