AWS managedservices medium security documentation change

Service: managedservices · 2025-06-28 · Security-related medium

File: managedservices/latest/userguide/defaults-instance-profile.md

Summary

Updated IAM policy examples: Changed 'EC2' to 'Amazon EC2' for consistency and modified KMS key ARN from wildcard 'key/*' to specific alias 'alias/ams/eps/cloudone-migration'

Security assessment

The change from a wildcard KMS key ('key/*') to a specific alias restricts decryption permissions to a specific resource, reducing potential attack surface. This implements least privilege principles for cryptographic operations.

Diff

diff --git a/managedservices/latest/userguide/defaults-instance-profile.md b/managedservices/latest/userguide/defaults-instance-profile.md
index bafa6a400..0bb5fbdc0 100644
--- a//managedservices/latest/userguide/defaults-instance-profile.md
+++ b//managedservices/latest/userguide/defaults-instance-profile.md
@@ -62 +62 @@ Explicitly Deny List Bucket S3 | Deny | ListBucket | Disallows you listing any e
-Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
+Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows Amazon EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
@@ -64 +64 @@ Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access s
-Trend Cloud One Decryption Key | Allow | Decrypt | Allow EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `aws:kms:*:*:key/*`  
+Trend Cloud One Decryption Key | Allow | Decrypt | Allow Amazon EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `arn:aws:kms:*:*:alias/ams/eps/cloudone-migration`