AWS fsx documentation change
Summary
Updated IAM policy documentation with new S3 access point permissions and policy changes
Security assessment
Documents new IAM permissions for S3 access point management, which are security-related features. No indication of addressing existing vulnerabilities.
Diff
diff --git a/fsx/latest/OpenZFSGuide/security-iam-awsmanpol.md b/fsx/latest/OpenZFSGuide/security-iam-awsmanpol.md index b573d02f7..25825aaa5 100644 --- a//fsx/latest/OpenZFSGuide/security-iam-awsmanpol.md +++ b//fsx/latest/OpenZFSGuide/security-iam-awsmanpol.md @@ -53,3 +53 @@ This policy includes the following permissions. - * `iam` – Allows principles to create an Amazon FSx service linked role on the user's behalf. This is required so that Amazon FSx can manage AWS resources on the user's behalf. - - * `logs` – Allows principals to create log groups, log streams, and write events to log streams. This is required so that users can monitor FSx for Windows File Server file system access by sending audit access logs to CloudWatch Logs. + * `iam` – Allows principles to create an Amazon FSx service-linked role on the user's behalf. This is required so that Amazon FSx can manage AWS resources on the user's behalf. @@ -58,0 +57,2 @@ This policy includes the following permissions. + * `logs` – Allows principals to create log groups, log streams, and write events to log streams. This is required so that users can monitor FSx for Windows File Server file system access by sending audit access logs to CloudWatch Logs. + @@ -92 +92 @@ This policy includes the following permissions. - * `iam` – Grants permission to create a service linked role that allows Amazon FSx to perform actions on the user's behalf. + * `iam` – Grants permission to create a service-linked role that allows Amazon FSx to perform actions on the user's behalf. @@ -152,0 +153,6 @@ Change | Description | Date +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:CreateAndAttachS3AccessPoint` that allows principals to create an S3 access point and attach it to an FSx volume. | June 25, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DescribeS3AccessPointAttachments` that allows principals to list all S3 access points in an AWS account in an AWS Region | June 25, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DetachAndDeleteS3AccessPoint` that allows principals to delete an S3 access point. | June 25, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:CreateAndAttachS3AccessPoint` that allows principals to create an S3 access point and attach it to an FSx volume. | June 25, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DescribeS3AccessPointAttachments` that allows principals to list all S3 access points in an AWS account in an AWS Region | June 25, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DetachAndDeleteS3AccessPoint` that allows principals to delete an S3 access point. | June 25, 2025