AWS fsx documentation change
Summary
Updated documentation for AWS managed policies with product specificity (OpenZFS), added S3 access point management permissions, and reorganized content
Security assessment
Added new IAM permissions (fsx:CreateAndAttachS3AccessPoint, DescribeS3AccessPointAttachments, UpdateS3AccessPointAttachments, DetachAndDeleteS3AccessPoint) related to S3 access point management. While these control access to security-sensitive operations, there's no indication of addressing a specific vulnerability. The changes document expanded security controls for new features.
Diff
diff --git a/fsx/latest/WindowsGuide/security-iam-awsmanpol.md b/fsx/latest/WindowsGuide/security-iam-awsmanpol.md index 5dc405065..dbe3cd4fe 100644 --- a//fsx/latest/WindowsGuide/security-iam-awsmanpol.md +++ b//fsx/latest/WindowsGuide/security-iam-awsmanpol.md @@ -7 +7 @@ AmazonFSxServiceRolePolicyAmazonFSxDeleteServiceLinkedRoleAccessAmazonFSxFullAcc -# AWS managed policies for Amazon FSx +# AWS managed policies for Amazon FSx for OpenZFS @@ -55,2 +54,0 @@ This policy includes the following permissions. - * `logs` – Allows principals to create log groups, log streams, and write events to log streams. This is required so that users can monitor FSx for Windows File Server file system access by sending audit access logs to CloudWatch Logs. - @@ -58,0 +57,2 @@ This policy includes the following permissions. + * `logs` – Allows principals to create log groups, log streams, and write events to log streams. This is required so that users can monitor FSx for Windows File Server file system access by sending audit access logs to CloudWatch Logs. + @@ -76 +76 @@ This policy includes the following permissions. - * `cloudwatch` – Allows principals to view CloudWatch Alarms and Metrics in the Amazon FSx management console. + * `cloudwatch` – Allows principals to view CloudWatch Alarms and metrics in the Amazon FSx management console. @@ -111 +111 @@ This policy includes the following permissions. - * `cloudwatch` – Allows principals to view CloudWatch Alarms and Metrics in the Amazon FSx Management Console. + * `cloudwatch` – Allows principals to view CloudWatch Alarms and metrics in the Amazon FSx Management Console. @@ -138,2 +137,0 @@ You can attach the `AmazonFSxReadOnlyAccess` policy to your IAM identities. -This policy grants administrative permissions that allow read-only access to Amazon FSx. - @@ -154,0 +153,8 @@ Change | Description | Date +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:CreateAndAttachS3AccessPoint` that allows principals to create an S3 and attach it to an FSx volume. | April 14, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DescribeS3AccessPointAttachments` that allows principals to list all S3 in an AWS account in an AWS Region | April 14, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:UpdateS3AccessPointAttachments` that allows principals to modify an existing S3 . | April 14, 2025 +AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DetachAndDeleteS3AccessPoint` that allows principals to delete an S3 . | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:CreateAndAttachS3AccessPoint` that allows principals to create an S3 and attach it to an FSx volume. | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DescribeS3AccessPointAttachments` that allows principals to list all S3 in an AWS account in an AWS Region | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:UpdateS3AccessPointAttachments` that allows principals to modify an existing S3 . | April 14, 2025 +AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added a new permission, `fsx:DetachAndDeleteS3AccessPoint` that allows principals to delete an S3 . | April 14, 2025 @@ -172 +177,0 @@ AmazonFSxConsoleFullAccess – Update to an existing policy | Amazon FSx updated -AmazonFSxFullAccess – Update to an existing policy | Amazon FSx added new permissions to allow Amazon FSx to manage network configurations for FSx for OpenZFS Multi-AZ file systems. | May 31, 2023