AWS evs medium security documentation change
Summary
Updated service-linked role documentation with clarified permissions and resource management details
Security assessment
Clarifies exact resources managed by service-linked role (EVS network interfaces/VLAN subnets instead of security groups/logs). Improves security posture by precisely defining permissions scope, reducing potential overprivileged access risks.
Diff
diff --git a/evs/latest/userguide/using-service-linked-roles.md b/evs/latest/userguide/using-service-linked-roles.md index 00fd16cdd..3dba7783e 100644 --- a//evs/latest/userguide/using-service-linked-roles.md +++ b//evs/latest/userguide/using-service-linked-roles.md @@ -15 +15 @@ Amazon Elastic VMware Service uses AWS Identity and Access Management (IAM) [ser -A service-linked role makes setting up Amazon EVS easier because you don’t have to manually add the necessary permissions. Amazon EVS defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon EVS can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. +A service-linked role makes setting up Amazon EVS easier because you don’t have to manually add the necessary permissions. Amazon EVS defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon EVS can assume its roles. The defined permissions include the trust policy and the permissions policy. The permissions policy cannot be attached to any other IAM entity. @@ -23 +23 @@ For information about other services that support service-linked roles, see [AWS -Amazon EVS uses the service-linked role named `AWSServiceRoleForAmazonEVS`. The role allows Amazon EVS to manage clusters in your account. The attached policies allow the role to manage the following resources: network interfaces, security groups, logs, and VPCs. +Amazon EVS uses the service-linked role named `AWSServiceRoleForAmazonEVS`. The role allows Amazon EVS to manage environments in your account. The attached policy allows the role to manage the following resources: EVS elastic network interfaces, EVS VLAN subnets, and VPCs. @@ -43 +43 @@ You must configure permissions to allow an IAM entity (such as a user, group, or -You don’t need to manually create a service-linked role. When you create a cluster in the AWS Management Console, the AWS CLI, or the AWS API, Amazon EVS creates the service-linked role for you. +You don’t need to manually create a service-linked role. When you create an environment in the AWS Management Console, the AWS CLI, or the AWS API, Amazon EVS creates the service-linked role for you.