AWS cli high security documentation change
Summary
Removed warning section about service-linked role permissions and updated CLI version reference
Security assessment
The removed warning explicitly described security implications of bypassing IAM permissions via service-linked roles, which is critical security context. Removing this warning could lead to misconfiguration risks.
Diff
diff --git a/cli/latest/reference/configservice/put-organization-conformance-pack.md b/cli/latest/reference/configservice/put-organization-conformance-pack.md index c44b6b6d4..9b64c4a86 100644 --- a//cli/latest/reference/configservice/put-organization-conformance-pack.md +++ b//cli/latest/reference/configservice/put-organization-conformance-pack.md @@ -15 +15 @@ - * [AWS CLI 2.27.45 Command Reference](../../index.html) » + * [AWS CLI 2.27.46 Command Reference](../../index.html) » @@ -63,6 +62,0 @@ Only a management account and a delegated administrator can call this API. When -### Warning - -When you use `PutOrganizationConformancePack` to deploy conformance packs across member accounts, the operation can create Config rules and remediation actions without requiring `config:PutConfigRule` or `config:PutRemediationConfigurations` permissions in member account IAM policies. - -This API uses the `AWSServiceRoleForConfigConforms` service-linked role in each member account to create conformance pack resources. This service-linked role includes the permissions to create Config rules and remediation configurations, even if member account IAM policies explicitly deny these actions. - @@ -130 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/config -> A string that contains the full conformance pack template body. Structure containing the template body with a minimum length of 1 byte and a maximum length of 51,200 bytes. +> A string containing full conformance pack template body. Structure containing the template body with a minimum length of 1 byte and a maximum length of 51,200 bytes. @@ -307 +301 @@ OrganizationConformancePackArn -> (string) - * [AWS CLI 2.27.45 Command Reference](../../index.html) » + * [AWS CLI 2.27.46 Command Reference](../../index.html) »