AWS elasticloadbalancing documentation change
Summary
Updated Elastic Load Balancing IAM documentation to include V1/V2 references, restructured condition keys sections, added new condition key examples (ListenerProtocol, SecurityPolicy, Scheme, SecurityGroup, Subnet), and revised policy examples for security controls.
Security assessment
The changes enhance documentation of IAM condition keys (e.g., SecurityPolicy, ListenerProtocol) used to enforce security controls like TLS protocols and internal schemes. While these are security-related features, there is no evidence of addressing a specific vulnerability. The updates improve clarity and completeness of security configuration guidance.
Diff
diff --git a/elasticloadbalancing/latest/userguide/security_iam_service-with-iam.md b/elasticloadbalancing/latest/userguide/security_iam_service-with-iam.md index 0d8fbb9a7..14a500c50 100644 --- a//elasticloadbalancing/latest/userguide/security_iam_service-with-iam.md +++ b//elasticloadbalancing/latest/userguide/security_iam_service-with-iam.md @@ -51 +51 @@ Include actions in a policy to grant permissions to perform the associated opera -To see a list of Elastic Load Balancing actions, see [Actions defined by Elastic Load Balancing](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-actions-as-permissions) in the _Service Authorization Reference_. +To see a list of Elastic Load Balancing actions, see [Actions defined by Elastic Load Balancing V2](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-actions-as-permissions) and [Actions defined by Elastic Load Balancing V1](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html#awselasticloadbalancing-actions-as-permissions) in the _Service Authorization Reference_. @@ -101 +101 @@ Some Elastic Load Balancing API actions support multiple resources. To specify m -To see a list of Elastic Load Balancing resource types and their ARNs, see [Resources defined by Elastic Load Balancing](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-resources-for-iam-policies) in the _Service Authorization Reference_. To learn with which actions you can specify the ARN of each resource, see [Actions defined by Elastic Load Balancing](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-actions-as-permissions). +To see a list of Elastic Load Balancing resource types and their ARNs, see [Resources defined by Elastic Load Balancing V2](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-resources-for-iam-policies) and [Resources defined by Elastic Load Balancing V1](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html#awselasticloadbalancing-resources-for-iam-policies) in the _Service Authorization Reference_. To learn with which actions you can specify the ARN of each resource, see [Actions defined by Elastic Load Balancing V2](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-actions-as-permissions) and [Actions defined by Elastic Load Balancing V1](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html#awselasticloadbalancing-actions-as-permissions). @@ -117 +117 @@ AWS supports global condition keys and service-specific condition keys. To see a -To see a list of Elastic Load Balancing condition keys, see [Condition keys for Elastic Load Balancing](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-policy-keys) in the _Service Authorization Reference_. To learn with which actions and resources you can use a condition key, see [Actions defined by Elastic Load Balancing](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-actions-as-permissions). +To see a list of Elastic Load Balancing condition keys, see [Condition keys for Elastic Load Balancing V2](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-policy-keys) and [Condition keys for Elastic Load Balancing V1](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html#awselasticloadbalancing-policy-keys) in the _Service Authorization Reference_. To learn with which actions and resources you can use a condition key, see [Actions defined by Elastic Load Balancing V2](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html#awselasticloadbalancingv2-actions-as-permissions) and [Actions defined by Elastic Load Balancing V1](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html#awselasticloadbalancing-actions-as-permissions). @@ -119 +119 @@ To see a list of Elastic Load Balancing condition keys, see [Condition keys for -### `elasticloadbalancing:ResourceTag` condition key +###### Condition keys @@ -121 +121 @@ To see a list of Elastic Load Balancing condition keys, see [Condition keys for -The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elastic Load Balancing. The following actions support this condition key: + * elasticloadbalancing:ListenerProtocol @@ -123,23 +123 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti -###### API version 2015-12-01 - - * `AddTags` - - * `CreateListener` - - * `CreateLoadBalancer` - - * `DeleteLoadBalancer` - - * `DeleteTargetGroup` - - * `DeregisterTargets` - - * `ModifyLoadBalancerAttributes` - - * `ModifyTargetGroup` - - * `ModifyTargetGroupAttributes` - - * `RegisterTargets` - - * `RemoveTags` + * elasticloadbalancing:SecurityPolicy @@ -147 +125 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `SetIpAddressType` + * elasticloadbalancing:Scheme @@ -149,10 +127 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `SetSecurityGroups` - - * `SetSubnets` - - - - -###### API version 2012-06-01 - - * `AddTags` + * elasticloadbalancing:SecurityGroup @@ -160 +129 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `ApplySecurityGroupsToLoadBalancer` + * elasticloadbalancing:Subnet @@ -162 +131 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `AttachLoadBalancersToSubnets` + * elasticloadbalancing:ResourceTag @@ -164 +132,0 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `ConfigureHealthCheck` @@ -166 +133,0 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `CreateAppCookieStickinessPolicy` @@ -168 +134,0 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `CreateLBCookieStickinessPolicy` @@ -170 +136 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `CreateLoadBalancer` +### elasticloadbalancing:ListenerProtocol condition key @@ -172,36 +138 @@ The `elasticloadbalancing:ResourceTag`/`key` condition key is specific to Elasti - * `CreateLoadBalancerListeners` - - * `CreateLoadBalancerPolicy` - - * `DeleteLoadBalancer` - - * `DeleteLoadBalancerListeners` - - * `DeleteLoadBalancerPolicy` - - * `DeregisterInstancesFromLoadBalancer` - - * `DetachLoadBalancersFromSubnets` - - * `DisableAvailabilityZonesForLoadBalancer` - - * `EnableAvailabilityZonesForLoadBalancer` - - * `ModifyLoadBalancerAttributes` - - * `RegisterInstancesWithLoadBalancer` - - * `RemoveTags` - - * `SetLoadBalancerListenerSSLCertificate` - - * `SetLoadBalancerPoliciesForBackendServer` - - * `SetLoadBalancerPoliciesOfListener` - - - - -### `elasticloadbalancing:ListenerProtocol` condition key - -The `elasticloadbalancing:ListenerProtocol` condition key can be used for conditions that define the types of listeners that can be created and used. The following actions support this condition key: +The `elasticloadbalancing:ListenerProtocol` condition key can be used for conditions that define the types of listeners that can be created and used. The policy is available for Application Load Balancers, Network Load Balancers, and Classic Load Balancers. The following actions support this condition key: @@ -227,20 +158 @@ The `elasticloadbalancing:ListenerProtocol` condition key can be used for condit -The policy is available for Application Load Balancers, Network Load Balancers, and Classic Load Balancers. The following is an example policy that only allows users to select one of the specified protocols for their listener. - -###### Supported protocols: - - * HTTPS - - * HTTP - - * TCP - - * SSL - - * TLS - - * UDP - - * TCP_UDP - - - +The following example policy requires users to select the HTTPS protocol for the listeners for their Application Load Balancers and the TLS protocol for the listeners for their Network Load Balancers. @@ -269 +181,27 @@ The policy is available for Application Load Balancers, Network Load Balancers, -### `elasticloadbalancing:SecurityPolicy` condition key +With a Classic Load Balancer, you can specify multiple listeners in a single call. Therefore, your policy must use a [multi-value context key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition_examples-multi-valued-context-keys.html), as shown in the following example. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:CreateLoadBalancerListeners" + ], + "Resource": "*", + "Condition": { + "ForAnyValue:StringEquals": { + "elasticloadbalancing:ListenerProtocol": [ + "TCP", + "HTTP", + "HTTPS" + ] + } + } + } + ] + } + +### elasticloadbalancing:SecurityPolicy condition key @@ -271 +209 @@ The policy is available for Application Load Balancers, Network Load Balancers, -The `elasticloadbalancing:SecurityPolicy` condition key can be used for conditions that define and enforce specific security policies on the load balancers. The following actions support this condition key: +The `elasticloadbalancing:SecurityPolicy` condition key can be used for conditions that define and enforce specific security policies on the load balancers. The policy is available for Application Load Balancers, Network Load Balancers and Classic Load Balancers. The following actions support this condition key: @@ -291 +229 @@ The `elasticloadbalancing:SecurityPolicy` condition key can be used for conditio -The policy is available for Application Load Balancers, Network Load Balancers and Classic Load Balancers. The following is an example policy that only allows users to select one of the specified security policies for their load balancer. +The following example policy requires users to select one of the specified security policies for their Application Load Balancers and Network Load Balancers. @@ -315 +253 @@ The policy is available for Application Load Balancers, Network Load Balancers a -### `elasticloadbalancing:Scheme` condition key +### elasticloadbalancing:Scheme condition key @@ -317 +255 @@ The policy is available for Application Load Balancers, Network Load Balancers a -The `elasticloadbalancing:Scheme` condition key can be used for conditions that define which scheme can be selected during load balancer creation. The following actions support this condition key: +The `elasticloadbalancing:Scheme` condition key can be used for conditions that define which scheme can be selected during load balancer creation. The policy is available for Application Load Balancers, Network Load Balancers, and Classic Load Balancers. The following actions support this condition key: @@ -333 +271 @@ The `elasticloadbalancing:Scheme` condition key can be used for conditions that -The policy is available for Application Load Balancers, Network Load Balancers, and Classic Load Balancers. The following is an example policy that only allows users to select one of the specified scheme for their load balancer. +The following example policy requires users to select the specified scheme for their load balancers. @@ -350 +288 @@ The policy is available for Application Load Balancers, Network Load Balancers, -### `elasticloadbalancing:Subnet` condition key +### `elasticloadbalancing:SecurityGroup` condition key @@ -354 +292 @@ The policy is available for Application Load Balancers, Network Load Balancers, -Elastic Load Balancing accepts all capitalizations of Subnet IDs. However, make sure to use the appropriate case insensitive condition operators, for example `StringEqualsIgnoreCase`. +Elastic Load Balancing accepts all capitalizations of security group IDs. However, make sure to use the appropriate case insensitive condition operators, for example `StringEqualsIgnoreCase`. @@ -356 +294 @@ Elastic Load Balancing accepts all capitalizations of Subnet IDs. However, make -The `elasticloadbalancing:Subnet` condition key can be used for conditions that define which subnets can be created and attached to load balancers. The following actions support this condition key: +The `elasticloadbalancing:SecurityGroup` condition key can be used for conditions that define which security groups can be applied to the load balancers. The policy is available for Application Load Balancers, Network Load Balancers and Classic Load Balancers. The following actions support this condition key: @@ -362 +300 @@ The `elasticloadbalancing:Subnet` condition key can be used for conditions that - * `SetSubnets` + * `SetSecurityGroups` @@ -371 +309 @@ The `elasticloadbalancing:Subnet` condition key can be used for conditions that - * `AttachLoadBalancerToSubnets` + * `ApplySecurityGroupsToLoadBalancer` @@ -376 +314 @@ The `elasticloadbalancing:Subnet` condition key can be used for conditions that -The policy is available for Application Load Balancers, Network Load Balancers, Gateway Load Balancers and Classic Load Balancers. The following is an example policy that only allows users to select one of the specified subnets for their load balancer. +The following example policy requires users to select one of the specified security groups for their load balancers. @@ -379 +316,0 @@ The policy is available for Application Load Balancers, Network Load Balancers, - { @@ -385 +322 @@ The policy is available for Application Load Balancers, Network Load Balancers, - "elasticloadbalancing:SetSubnets"