AWS efs documentation change
Summary
Reorganized content, added regional support section, replaced inline IAM policy example with IAM User Guide references, and updated service-linked role management procedures.
Security assessment
Changes include improved references to IAM documentation about service-linked role permissions and cleanup procedures, which enhances security guidance. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/efs/latest/ug/using-service-linked-roles.md b/efs/latest/ug/using-service-linked-roles.md index 6ecc63cd4..25567d0c1 100644 --- a//efs/latest/ug/using-service-linked-roles.md +++ b//efs/latest/ug/using-service-linked-roles.md @@ -5 +5 @@ -Service-linked role permissions for Amazon EFSCreating a service-linked role for Amazon EFSEditing a service-linked role for Amazon EFSDeleting a service-linked role for Amazon EFS +Service-linked role permissions for Amazon EFSCreating a service-linked role for Amazon EFSEditing a service-linked role for Amazon EFSDeleting a service-linked role for Amazon EFSSupported Regions for Amazon EFS service-linked roles @@ -17,7 +17 @@ The service-linked role enables all API calls to be visible through AWS CloudTra -## Service-linked role permissions for Amazon EFS - -Amazon EFS uses the service-linked role named `AWSServiceRoleForAmazonElasticFileSystem` to allow Amazon EFS to call and manage AWS resources on behalf of your EFS file systems. - -The AWSServiceRoleForAmazonElasticFileSystem service-linked role trusts the following services to assume the role: - - * `elasticfilesystem.amazonaws.com` +For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the _IAM User Guide_. @@ -24,0 +19 @@ The AWSServiceRoleForAmazonElasticFileSystem service-linked role trusts the foll +## Service-linked role permissions for Amazon EFS @@ -25,0 +21 @@ The AWSServiceRoleForAmazonElasticFileSystem service-linked role trusts the foll +Amazon EFS uses the service-linked role named **AWSServiceRoleForAmazonElasticFileSystem** to allow Amazon EFS to call and manage AWS resources on behalf of your EFS file systems. @@ -26,0 +23 @@ The AWSServiceRoleForAmazonElasticFileSystem service-linked role trusts the foll +The AWSServiceRoleForAmazonElasticFileSystem service-linked role trusts the `elasticfilesystem.amazonaws.com` to assume the role. @@ -120,5 +117 @@ The role permissions policy allows Amazon EFS to complete the actions included i -You must manually configure IAM permissions for AWS KMS when creating a new Amazon EFS file system that is encrypted at rest. To learn more, see [Encrypting data at rest](./encryption-at-rest.html). - -## Creating a service-linked role for Amazon EFS - -You must configure permissions to allow an IAM entity (such as a user, group, or role) to create a service-linked role. Do this by adding the `iam:CreateServiceLinkedRole` permission to an IAM entity as shown in the following example. +You must manually configure IAM permissions for AWS KMS when creating a new EFS file system that is encrypted at rest. To learn more, see [Encrypting data at rest](./encryption-at-rest.html). @@ -125,0 +119 @@ You must configure permissions to allow an IAM entity (such as a user, group, or +You must configure permissions to allow an IAM entity (such as a user, group, or role) to create, edit, or delete a service-linked role. For more information, see [ Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the _IAM User Guide_. @@ -127,12 +121 @@ You must configure permissions to allow an IAM entity (such as a user, group, or - { - "Action": "iam:CreateServiceLinkedRole", - "Effect": "Allow", - "Resource": "*", - "Condition": { - "StringEquals": { - "iam:AWSServiceName": [ - "elasticfilesystem.amazonaws.com" - ] - } - } - } +## Creating a service-linked role for Amazon EFS @@ -140 +123 @@ You must configure permissions to allow an IAM entity (such as a user, group, or -For more information, see [ Service-Linked Role Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the _IAM User Guide_. +In most cases, you don't need to manually create a service-linked role. When you create mount targets or a replication configuration for your EFS file system in the AWS Management Console, the AWS CLI, or the AWS API, Amazon EFS creates the service-linked role for you. @@ -142 +125 @@ For more information, see [ Service-Linked Role Permissions](https://docs.aws.am -You don't need to manually create a service-linked role. When you create mount targets or a replication configuration for your EFS file system in the AWS Management Console, the AWS CLI, or the AWS API, Amazon EFS creates the service-linked role for you. +Additionally, if you manually delete this service-linked-role, and then need to create it again, you can use the same process to recreate the role in your account. When you create mount targets or a replication configuration for your EFS file system, Amazon EFS creates the service-linked role for you. @@ -144 +127 @@ You don't need to manually create a service-linked role. When you create mount t -If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account. When you create mount targets or a replication configuration for your EFS file system, Amazon EFS creates the service-linked role for you again. +If, however, Amazon EFS does not create the service-linked-role or if you started using Amazon EFS before it supported service-linked roles, then you can manually create the service-linked role. For instructions, see [ Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create-service-linked-role.html) in the _IAM User Guide_. @@ -148 +131 @@ If you delete this service-linked role, and then need to create it again, you ca -Amazon EFS doesn't allow you to edit the `AWSServiceRoleForAmazonElasticFileSystem` service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a Service-Linked Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. +Amazon EFS doesn't allow you to edit the `AWSServiceRoleForAmazonElasticFileSystem` service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Update a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-service-linked-role.html) in the _IAM User Guide_. @@ -152 +135 @@ Amazon EFS doesn't allow you to edit the `AWSServiceRoleForAmazonElasticFileSyst -If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don't have an unused entity that is not actively monitored or maintained. However, you must clean up the resources for your service-linked role before you can manually delete it. +If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don't have an unused entity that is not actively monitored or maintained. However, you must clean up the resources for your service-linked role before you can manually delete it. For more information, see [Clean up resources and protect your AWS account](./getting-started.html#gs-step-five-cleanup). @@ -158,16 +141 @@ If the Amazon EFS service is using the role when you try to delete the resources -###### To delete Amazon EFS resources used by the AWSServiceRoleForAmazonElasticFileSystem - -Complete the following steps to delete Amazon EFS resources used by the AWSServiceRoleForAmazonElasticFileSystem. For the detailed procedure, see [Clean up resources and protect your AWS account](./getting-started.html#gs-step-five-cleanup). - - 1. On your Amazon EC2 instance, unmount the Amazon EFS file system. - - 2. Delete the Amazon EFS file system. - - 3. Delete the custom security group for the file system. - -###### Warning - -If you used the default security group for your virtual private cloud (VPC), **do not** delete that security group. - - - +Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAmazonElasticFileSystem service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html#id_roles_manage_delete_slr) in the _IAM User Guide_. @@ -175 +143 @@ If you used the default security group for your virtual private cloud (VPC), **d -**To manually delete the service-linked role using IAM** +## Supported Regions for Amazon EFS service-linked roles @@ -177 +145 @@ If you used the default security group for your virtual private cloud (VPC), **d -Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAmazonElasticFileSystem service-linked role. For more information, see [Deleting a Service-Linked Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_. +Amazon EFS supports using service-linked roles in all of the AWS Regions where the service is available. For more information, see [AWS service endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _AWS General Reference User Guide_.