AWS IAM documentation change
Summary
Updated federated user reference to specify SAML/OIDC federation protocols in CLI context
Security assessment
The change adds explicit references to SAML and OIDC federation protocols, which are security-related authentication standards. However, this appears to be a documentation clarification rather than addressing a specific security vulnerability. The update improves accuracy of security feature documentation but doesn't indicate a security fix.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_use_switch-role-cli.md b/IAM/latest/UserGuide/id_roles_use_switch-role-cli.md index b70c00199..751d8e6c7 100644 --- a//IAM/latest/UserGuide/id_roles_use_switch-role-cli.md +++ b//IAM/latest/UserGuide/id_roles_use_switch-role-cli.md @@ -25 +25 @@ If you use role chaining, your session duration is limited to a maximum of one h -Imagine that you are an IAM user for working in the development environment. In this scenario, you occasionally need to work with the production environment at the command line with the [AWS CLI](http://aws.amazon.com/cli/). You already have an access key credential set available to you. This can be the access key pair that is assigned to your standard IAM user. Or, if you signed in as a federated user, it can be the access key pair for the role that was initially assigned to you. If your current permissions grant you the ability to assume a specific IAM role, then you can identify that role in a "profile" in the AWS CLI configuration files. That command is then run with the permissions of the specified IAM role, not the original identity. Note that when you specify that profile in an AWS CLI command, you are using the new role. In this situation, you cannot make use of your original permissions in the development account at the same time. The reason is that only one set of permissions can be in effect at a time. +Imagine that you are an IAM user for working in the development environment. In this scenario, you occasionally need to work with the production environment at the command line with the [AWS CLI](http://aws.amazon.com/cli/). You already have an access key credential set available to you. This can be the access key pair that is assigned to your standard IAM user. Or, if you signed in as a SAML or OIDC federated principal, it can be the access key pair for the role that was initially assigned to you. If your current permissions grant you the ability to assume a specific IAM role, then you can identify that role in a "profile" in the AWS CLI configuration files. That command is then run with the permissions of the specified IAM role, not the original identity. Note that when you specify that profile in an AWS CLI command, you are using the new role. In this situation, you cannot make use of your original permissions in the development account at the same time. The reason is that only one set of permissions can be in effect at a time.