AWS AWSEC2 medium security documentation change

Service: AWSEC2 · 2025-07-04 · Security-related medium

File: AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md

Summary

Updated IAM policy example: Removed 'iam:CreateServiceLinkedRole' from one action, added it to another, expanded resource ARNs to include security groups/network-interfaces/endpoints, and simplified Sid value.

Security assessment

The change refines IAM permissions by restricting where 'iam:CreateServiceLinkedRole' is allowed and adds explicit resource ARNs for least-privilege access. This directly impacts security by tightening permission scopes and preventing potential over-provisioning of privileges.

Diff

diff --git a/AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md b/AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md
index 3ae907dfd..4754c7808 100644
--- a//AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md
+++ b//AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md
@@ -65,2 +65 @@ In the following example IAM policy, the `Resource` section grants permission to
-                    "ec2:CreateTags",
-                    "iam:CreateServiceLinkedRole"
+                    "ec2:CreateTags"
@@ -69 +68,6 @@ In the following example IAM policy, the `Resource` section grants permission to
-                "Resource": "arn:aws:ec2:region:account-id:subnet/*"
+                "Resource": [
+                    "arn:aws:ec2:region:account-id:subnet/*",
+                    "arn:aws:ec2:region:account-id:security-group/*",
+                    "arn:aws:ec2:region:account-id:network-interface/*",
+                    "arn:aws:ec2:region:account-id:instance-connect-endpoint/*"
+                ]
@@ -73 +77 @@ In the following example IAM policy, the `Resource` section grants permission to
-                    "ec2:CreateNetworkInterface"
+                    "iam:CreateServiceLinkedRole"
@@ -76 +80,3 @@ In the following example IAM policy, the `Resource` section grants permission to
-                "Resource": "arn:aws:ec2:::security-group/*"
+                "Resource": [
+                    "arn:aws:iam::account-id:role/aws-service-role/ec2-instance-connect.amazonaws.com/AWSServiceRoleForEc2InstanceConnect"
+                ]
@@ -79 +85 @@ In the following example IAM policy, the `Resource` section grants permission to
-                "Sid": "DescribeInstanceConnectEndpoints",
+                "Sid": "Describe",