AWS pcs documentation change
Summary
Replaced detailed IAM policy JSON with reference to AWS Managed Policy documentation
Security assessment
Change removes inline policy details in favor of referencing managed policy documentation. While IAM policies relate to security, this appears to be a documentation restructuring rather than addressing a specific security vulnerability or adding new security guidance.
Diff
diff --git a/pcs/latest/userguide/security-iam-awsmanpol.md b/pcs/latest/userguide/security-iam-awsmanpol.md index a6db9918f..13779cd0e 100644 --- a//pcs/latest/userguide/security-iam-awsmanpol.md +++ b//pcs/latest/userguide/security-iam-awsmanpol.md @@ -36,211 +36 @@ This policy includes the following permissions. - - { - "Version" : "2012-10-17", - "Statement" : [ - { - "Sid" : "PermissionsToCreatePCSNetworkInterfaces", - "Effect" : "Allow", - "Action" : [ - "ec2:CreateNetworkInterface" - ], - "Resource" : "arn:aws:ec2:*:*:network-interface/*", - "Condition" : { - "Null" : { - "aws:RequestTag/AWSPCSManaged" : "false" - } - } - }, - { - "Sid" : "PermissionsToCreatePCSNetworkInterfacesInSubnet", - "Effect" : "Allow", - "Action" : [ - "ec2:CreateNetworkInterface" - ], - "Resource" : [ - "arn:aws:ec2:*:*:subnet/*", - "arn:aws:ec2:*:*:security-group/*" - ] - }, - { - "Sid" : "PermissionsToManagePCSNetworkInterfaces", - "Effect" : "Allow", - "Action" : [ - "ec2:DeleteNetworkInterface", - "ec2:CreateNetworkInterfacePermission" - ], - "Resource" : "arn:aws:ec2:*:*:network-interface/*", - "Condition" : { - "Null" : { - "aws:ResourceTag/AWSPCSManaged" : "false" - } - } - }, - { - "Sid" : "PermissionsToDescribePCSResources", - "Effect" : "Allow", - "Action" : [ - "ec2:DescribeSubnets", - "ec2:DescribeVpcs", - "ec2:DescribeNetworkInterfaces", - "ec2:DescribeLaunchTemplates", - "ec2:DescribeLaunchTemplateVersions", - "ec2:DescribeInstances", - "ec2:DescribeInstanceTypes", - "ec2:DescribeInstanceStatus", - "ec2:DescribeInstanceAttribute", - "ec2:DescribeSecurityGroups", - "ec2:DescribeKeyPairs", - "ec2:DescribeImages", - "ec2:DescribeImageAttribute" - ], - "Resource" : "*" - }, - { - "Sid" : "PermissionsToCreatePCSLaunchTemplates", - "Effect" : "Allow", - "Action" : [ - "ec2:CreateLaunchTemplate" - ], - "Resource" : "arn:aws:ec2:*:*:launch-template/*", - "Condition" : { - "Null" : { - "aws:RequestTag/AWSPCSManaged" : "false" - } - } - }, - { - "Sid" : "PermissionsToManagePCSLaunchTemplates", - "Effect" : "Allow", - "Action" : [ - "ec2:DeleteLaunchTemplate", - "ec2:DeleteLaunchTemplateVersions", - "ec2:CreateLaunchTemplateVersion" - ], - "Resource" : "arn:aws:ec2:*:*:launch-template/*", - "Condition" : { - "Null" : { - "aws:ResourceTag/AWSPCSManaged" : "false" - } - } - }, - { - "Sid" : "PermissionsToTerminatePCSManagedInstances", - "Effect" : "Allow", - "Action" : [ - "ec2:TerminateInstances" - ], - "Resource" : "arn:aws:ec2:*:*:instance/*", - "Condition" : { - "Null" : { - "aws:ResourceTag/AWSPCSManaged" : "false" - } - } - }, - { - "Sid" : "PermissionsToPassRoleToEC2", - "Effect" : "Allow", - "Action" : "iam:PassRole", - "Resource" : [ - "arn:aws:iam::*:role/*/AWSPCS*", - "arn:aws:iam::*:role/AWSPCS*", - "arn:aws:iam::*:role/aws-pcs/*", - "arn:aws:iam::*:role/*/aws-pcs/*" - ], - "Condition" : { - "StringEquals" : { - "iam:PassedToService" : [ - "ec2.amazonaws.com" - ] - } - } - }, - { - "Sid" : "PermissionsToControlClusterInstanceAttributes", - "Effect" : "Allow", - "Action" : [ - "ec2:RunInstances", - "ec2:CreateFleet" - ], - "Resource" : [ - "arn:aws:ec2:*::image/*", - "arn:aws:ec2:*::snapshot/*", - "arn:aws:ec2:*:*:subnet/*", - "arn:aws:ec2:*:*:network-interface/*", - "arn:aws:ec2:*:*:security-group/*", - "arn:aws:ec2:*:*:volume/*", - "arn:aws:ec2:*:*:key-pair/*", - "arn:aws:ec2:*:*:launch-template/*", - "arn:aws:ec2:*:*:placement-group/*", - "arn:aws:ec2:*:*:capacity-reservation/*", - "arn:aws:resource-groups:*:*:group/*", - "arn:aws:ec2:*:*:fleet/*", - "arn:aws:ec2:*:*:spot-instances-request/*" - ] - }, - { - "Sid" : "PermissionsToProvisionClusterInstances", - "Effect" : "Allow", - "Action" : [ - "ec2:RunInstances", - "ec2:CreateFleet" - ], - "Resource" : [ - "arn:aws:ec2:*:*:instance/*" - ], - "Condition" : { - "Null" : { - "aws:RequestTag/AWSPCSManaged" : "false" - } - } - }, - { - "Sid" : "PermissionsToTagPCSResources", - "Effect" : "Allow", - "Action" : [ - "ec2:CreateTags" - ], - "Resource" : [ - "*" - ], - "Condition" : { - "StringEquals" : { - "ec2:CreateAction" : [ - "RunInstances", - "CreateLaunchTemplate", - "CreateFleet", - "CreateNetworkInterface" - ] - } - } - }, - { - "Sid" : "PermissionsToPublishMetrics", - "Effect" : "Allow", - "Action" : "cloudwatch:PutMetricData", - "Resource" : "*", - "Condition" : { - "StringEquals" : { - "cloudwatch:namespace" : "AWS/PCS" - } - } - }, - { - "Sid" : "PermissionsToManageSecret", - "Effect" : "Allow", - "Action" : [