AWS managedservices medium security documentation change

Service: managedservices · 2025-06-28 · Security-related medium

File: managedservices/latest/onboardingguide/defaults-instance-profile.md

Summary

Updated IAM policy descriptions to use 'Amazon EC2' terminology and corrected KMS key ARN format

Security assessment

The KMS key ARN correction (from wildcard 'key/*' to specific alias) tightens permissions, reducing potential over-permissive access. This addresses a security control gap in cryptographic key management.

Diff

diff --git a/managedservices/latest/onboardingguide/defaults-instance-profile.md b/managedservices/latest/onboardingguide/defaults-instance-profile.md
index 492412248..805e6d18f 100644
--- a//managedservices/latest/onboardingguide/defaults-instance-profile.md
+++ b//managedservices/latest/onboardingguide/defaults-instance-profile.md
@@ -62 +62 @@ Explicitly Deny List Bucket S3 | Deny | ListBucket | Disallows you listing any e
-Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
+Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows Amazon EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
@@ -64 +64 @@ Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access s
-Trend Cloud One Decryption Key | Allow | Decrypt | Allow EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `aws:kms:*:*:key/*`  
+Trend Cloud One Decryption Key | Allow | Decrypt | Allow Amazon EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `arn:aws:kms:*:*:alias/ams/eps/cloudone-migration`