AWS filegateway documentation change
Summary
Clarified IAM permissions for cache reports, added STS AssumeRole requirement, and recommended VPC endpoint alignment.
Security assessment
The changes improve documentation around required IAM permissions and secure network configuration (VPC endpoints), which are security best practices. However, there is no evidence these changes address a specific security vulnerability.
Diff
diff --git a/filegateway/latest/files3/create-cache-report.md b/filegateway/latest/files3/create-cache-report.md index d287f2a55..1e9acb1f5 100644 --- a//filegateway/latest/files3/create-cache-report.md +++ b//filegateway/latest/files3/create-cache-report.md @@ -11 +11 @@ S3 File Gateway can generate a report of the metadata for files that are current - * You must have `s3:PutObject` and `s3:AbortMultipartUpload` permissions for the Amazon S3 bucket where you want to store the cache report. + * Your gateway must have `s3:PutObject` and `s3:AbortMultipartUpload` permissions for the Amazon S3 bucket where you want to store the cache report. @@ -44 +44 @@ The IAM role you specify must have the following permissions to write objects to - * s3:PutObject + * `s3:PutObject` @@ -46 +46,3 @@ The IAM role you specify must have the following permissions to write objects to - * s3:AbortMultipartUpload + * `s3:AbortMultipartUpload` + +The role must also allow the `storagegateway.amazonaws.com` service to assume the role using the `sts:AssumeRole` action. @@ -73,0 +76,4 @@ The **Files Failing Upload** flag is reset every 24 hours and during gateway reb +###### Note + +If your file share uses a VPC endpoint to connect to Amazon S3 for normal operations, we recommend using the same VPC when you configure your cache report. Cache report creation will fail if the gateway can't connect to the Amazon S3 bucket for any reason, including invalid VPC configuration. +