AWS awssupport documentation change
Summary
Added documentation for AWSSupportAccess policy and expanded permissions in AWSSupportServiceRolePolicy across multiple AWS services
Security assessment
The changes document expanded permissions for AWS Support roles to troubleshoot various services, including security-related services like GuardDuty and Security Hub. While this relates to access control, there's no evidence of addressing a specific security vulnerability - rather expanding support capabilities. The documentation addition itself constitutes security documentation about managed policies.
Diff
diff --git a/awssupport/latest/user/aws-managed-policies-aws-support.md b/awssupport/latest/user/aws-managed-policies-aws-support.md index c1c3aef70..1883dfbf1 100644 --- a//awssupport/latest/user/aws-managed-policies-aws-support.md +++ b//awssupport/latest/user/aws-managed-policies-aws-support.md @@ -5 +5 @@ -AWSSupportServiceRolePolicyPolicy updates +AWSSupportAccessAWSSupportServiceRolePolicyPolicy updates @@ -12,0 +13,2 @@ AWS Support has the following managed policies. + * [AWS managed policy: AWSSupportAccess](./aws-managed-policies-aws-support.html#security-iam-awsmanpol-AWSSupportAccess) + @@ -21,0 +24,6 @@ AWS Support has the following managed policies. +## AWS managed policy: AWSSupportAccess + +AWS Support uses the [AWSSupportAccess](https://console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/aws-service-role/AWSSupportAccess$jsonEditor) AWS managed policy. This policy manages your support case lifecycle through the Support API. You can attach this policy to your IAM entities. For more information, see [Service-linked role permissions for Support](./using-service-linked-roles-sup.html#service-linked-role-permissions). + +To view the permissions for this policy, see [AWSSupportAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSupportAccess.html) in the _AWS Managed Policy Reference_. + @@ -25,0 +34,2 @@ AWS Support uses the [AWSSupportServiceRolePolicy](https://console.aws.amazon.co +To view the permissions for this policy, see [AWSSupportServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSupportServiceRolePolicy.html) in the _AWS Managed Policy Reference_. + @@ -35,0 +46,46 @@ AWS Support Change | Description | Date +AWSSupportServiceRolePolicy – Update to an existing policy | Added 257 new permissions to the following services to perform actions that help troubleshoot customer issues related to billing, administrative, and technical support: + + * AWS App Runner – To debug issues related to AWS App Runner. + * AWS AppSync – To troubleshoot issues related to AWS AppSync. + * AWS Batch – To debug issues related to AWS Batch. + * Amazon Bedrock – To troubleshoot issues related to Amazon Bedrock. + * Amazon CloudFront – To debug issues related to Amazon CloudFront. + * AWS CodePipeline – To troubleshoot issues related to AWS Config. + * AWS Config – To troubleshoot issues related to Amazon Connect. + * Amazon Connect – To debug issues related to Amazon Connect. + * AWS DataSync – To debug issues related to AWS DataSync. + * AWS Direct Connect – To troubleshoot issues related to the AWS Direct Connect. + * Amazon EC2 – To troubleshoot issues related to the Amazon EC2. + * AWS Fault Injection Service – To debug issues related to the AWS Fault Injection Service. + * AWS Firewall Manager – To troubleshoot issues related to the AWS Firewall Manager. + * AWS Glue – To debug issues related to the AWS Glue. + * Amazon GuardDuty – To debug issues related to the Amazon GuardDuty. + * EC2 Image Builder – To troubleshoot issues related to the EC2 Image Builder. + * AWS IoT – To troubleshoot issues related to the AWS IoT. + * AWS IoT FleetWise – To debug issues related to the AWS IoT FleetWise. + * Amazon CloudWatch Logs – To debug issues related to the Amazon CloudWatch Logs. + * AWS Elemental MediaLive – To debug issues related to the AWS Elemental MediaLive. + * Network Flow Monitor – To troubleshoot issues related to the Network Flow Monitor. + * AWS Network Manager – To troubleshoot issues related to AWS Network Manager. + * Amazon CloudWatch Observability Admin Service – To troubleshoot issues related to the Amazon CloudWatch Observability Admin Service. + * AWS Parallel Computing Service – To debug issues related to the AWS Parallel Computing Service. + * Amazon Redshift Serverless – To troubleshoot issues related to the Amazon Redshift Serverless. + * Amazon Redshift – To troubleshoot issues related to the Amazon Redshift. + * AWS Resilience Hub – To debug issues related to the AWS Resilience Hub. + * AWS Identity and Access Management Roles Anywhere– To debug issues related to the AWS Identity and Access Management Roles Anywhere. + * Amazon S3 on Outposts – To troubleshoot issues related to the Amazon S3 on Outposts. + * Amazon S3 – To troubleshoot issues related to the Amazon S3. + * Amazon S3 Tables– To troubleshoot issues related to the Amazon S3 Tables. + * Amazon SageMaker AI – To debug issues related to the Amazon SageMaker AI. + * AWS Security Hub – To debug issues related to the AWS Security Hub. + * Amazon SQS – To debug issues related to the Amazon SQS. + * AWS Systems Manager Incident Manager – To troubleshoot issues related to the AWS Systems Manager Incident Manager. + * AWS Systems Manager Quick Setup– To debug issues related to the AWS Systems Manager Quick Setup. + * AWS Systems Manager – To debug issues related to the AWS Systems Manager. + * Amazon WorkSpaces Thin Client– To troubleshoot issues related to the Amazon WorkSpaces Thin Client. + * Amazon Timestream – To debug issues related to the Amazon Timestream. + * AWS Telco Network Builder– To troubleshoot issues related to the AWS Telco Network Builder. + * AWS Transfer Family – To debug issues related to the AWS Transfer Family. + * Amazon VPC Lattice – To troubleshoot issues related to the Amazon VPC Lattice. + +| Jun 17, 2025