AWS fsx documentation change
Summary
Updated documentation for AWS managed policies related to FSx for OpenZFS, including new permissions for S3 access point management, enhanced security group validation, and audit logging configuration. Added changelog entries for recent policy updates.
Security assessment
The changes add documentation for new S3 access point management permissions (fsx:CreateAndAttachS3AccessPoint etc.) and clarify security-related capabilities like enhanced security group validation (ec2:GetSecurityGroupsForVpc) and audit logging via CloudWatch. While these relate to security features, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/fsx/latest/LustreGuide/security-iam-awsmanpol.md b/fsx/latest/LustreGuide/security-iam-awsmanpol.md index cd9495ec1..b39a42037 100644 --- a//fsx/latest/LustreGuide/security-iam-awsmanpol.md +++ b//fsx/latest/LustreGuide/security-iam-awsmanpol.md @@ -7 +7 @@ AmazonFSxServiceRolePolicyAmazonFSxDeleteServiceLinkedRoleAccessAmazonFSxFullAcc -# AWS managed policies for Amazon FSx +# AWS managed policies for Amazon FSx for OpenZFS @@ -29 +29 @@ This policy grants administrative permissions that allow Amazon FSx to delete it -This policy includes permissions in `iam` to allow Amazon FSx to view, delete, and view the deletion status for the FSx Service Linked Role for Amazon S3 access. +This policy includes permissions in `iam` to allow Amazon FSx to view, delete, and view the deletion status for the FSx Service Linked Roles for Amazon S3 access. @@ -55,2 +54,0 @@ This policy includes the following permissions. - * `logs` – Allows principals to create log groups, log streams, and write events to log streams. This is required so that users can monitor FSx for Windows File Server file system access by sending audit access logs to CloudWatch Logs. - @@ -58,0 +57,2 @@ This policy includes the following permissions. + * `logs` – Allows principals to create log groups, log streams, and write events to log streams. This is required so that users can monitor FSx for Windows File Server file system access by sending audit access logs to CloudWatch Logs. + @@ -138,2 +137,0 @@ You can attach the `AmazonFSxReadOnlyAccess` policy to your IAM identities. -This policy includes the following permissions. - @@ -142 +140 @@ This policy includes the following permissions. - * `ec2` – Allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. + * `ec2` – To provide enhanced security group validation of all security groups that can be used with a VPC. @@ -154,0 +153,8 @@ Change | Description | Date +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:CreateAndAttachS3AccessPoint` that allows principals to create an S3 and attach it to an FSx volume. | April 14, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DescribeS3AccessPointAttachments` that allows principals to list all S3 in an AWS account in an AWS Region | April 14, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:UpdateS3AccessPointAttachments` that allows principals to modify an existing S3 . | April 14, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DetachAndDeleteS3AccessPoint` that allows principals to delete an S3 . | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:CreateAndAttachS3AccessPoint` that allows principals to create an S3 and attach it to an FSx volume. | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DescribeS3AccessPointAttachments` that allows principals to list all S3 in an AWS account in an AWS Region | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:UpdateS3AccessPointAttachments` that allows principals to modify an existing S3 . | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DetachAndDeleteS3AccessPoint` that allows principals to delete an S3 . | April 14, 2025 @@ -157,5 +163,5 @@ AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added n -[AmazonFSxServiceRolePolicy](./using-service-linked-roles.html#slr-permissions) – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 09, 2024 -AmazonFSxReadOnlyAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 09, 2024 -AmazonFSxConsoleReadOnlyAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 09, 2024 -AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 09, 2024 -AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 09, 2024 +[AmazonFSxServiceRolePolicy](./using-service-linked-roles.html#slr-permissions) – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 9, 2024 +AmazonFSxReadOnlyAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 9, 2024 +AmazonFSxConsoleReadOnlyAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 9, 2024 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 9, 2024 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added new permission, `ec2:GetSecurityGroupsForVpc` that allows principals to provide enhanced security group validation of all security groups that can be used with a VPC. | January 9, 2024 @@ -164,2 +170,2 @@ AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added n -AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission to enable users to perform on-demand replication of volumes for FSx for OpenZFS file systems. | November 26, 2023 -AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission to enable users to perform on-demand replication of volumes for FSx for OpenZFS file systems. | November 26, 2023 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added new permission to enable users to perform on-demand replication of volumes for FSx for OpenZFS file systems. | November 26, 2023 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added new permission to enable users to perform on-demand replication of volumes for FSx for OpenZFS file systems. | November 26, 2023