AWS keyspaces documentation change
Summary
Added documentation for new AWS managed policy KeyspacesCDCServiceRolePolicy and updated existing policies (AmazonKeyspacesReadOnlyAccess_v2, AmazonKeyspacesReadOnlyAccess, AmazonKeyspacesFullAccess) to include CDC stream viewing permissions and service-linked role details
Security assessment
The changes document IAM policy updates for CDC stream monitoring and service-linked roles, which are security-related features. However, there's no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/keyspaces/latest/devguide/security-iam-awsmanpol.md b/keyspaces/latest/devguide/security-iam-awsmanpol.md index 6e2830186..20bcfb8df 100644 --- a//keyspaces/latest/devguide/security-iam-awsmanpol.md +++ b//keyspaces/latest/devguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AmazonKeyspacesReadOnlyAccess_v2AmazonKeyspacesReadOnlyAccessAmazonKeyspacesFullAccessPolicy updates +AmazonKeyspacesReadOnlyAccess_v2AmazonKeyspacesReadOnlyAccessAmazonKeyspacesFullAccessKeyspacesCDCServiceRolePolicyPolicy updates @@ -28,0 +29,2 @@ This policy includes the following permissions. + * `Amazon Keyspaces CDC streams` – Allows principals to view Amazon Keyspaces CDC streams. + @@ -53,0 +56,2 @@ This policy includes the following permissions. + * `Amazon Keyspaces CDC streams` – Allows principals to view Amazon Keyspaces CDC streams. + @@ -82,0 +87,2 @@ This policy includes the following permissions. + * `Amazon Keyspaces CDC streams` – When an administrator enables a stream for a table, Amazon Keyspaces creates the service-linked role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams) to publish CloudWatch metrics into your account on your behalf. + @@ -95,0 +102,17 @@ To review the policy in `JSON` format, see [AmazonKeyspacesFullAccess](https://d +## AWS managed policy: KeyspacesCDCServiceRolePolicy + +You can't attach `KeyspacesCDCServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon Keyspaces to perform actions on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](./using-service-linked-roles-CDC-streams.html). + +This policy grants the required permissions to the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish Amazon Keyspaces CDC stream metrics data to CloudWatch on your behalf. + +**Permissions details** + +This policy includes the following permissions. + + * `CloudWatch` – Allows the service-linked-role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams) to publish metric data from Amazon Keyspaces CDC streams into the `"cloudwatch:namespace": "AWS/Cassandra"` in your CloudWatch account on your behalf. + + + + +To review the policy in `JSON` format, see [KeyspacesCDCServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/KeyspacesCDCServiceRolePolicy.html). + @@ -101,0 +125,4 @@ Change | Description | Date +KeyspacesCDCServiceRolePolicy – New policy | Amazon Keyspaces added a new managed policy `KeyspacesCDCServiceRolePolicy` which grants the required permissions to the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish Amazon Keyspaces CDC stream metrics data to CloudWatch on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](./using-service-linked-roles-CDC-streams.html). | July 02, 2025 +AmazonKeyspacesReadOnlyAccess_v2 – Update to an existing policy | Amazon Keyspaces added new permissions to allow IAM principals to view Amazon Keyspaces CDC streams. For more information, see [View CDC streams in Amazon Keyspaces](./keyspaces-view-cdc.html). | July 02, 2025 +AmazonKeyspacesReadOnlyAccess – Update to an existing policy | Amazon Keyspaces added new permissions to allow IAM principals to view Amazon Keyspaces CDC streams. For more information, see [View CDC streams in Amazon Keyspaces](./keyspaces-view-cdc.html). | July 02, 2025 +AmazonKeyspacesFullAccess – Update to an existing policy | Amazon Keyspaces created the `KeyspacesCDCServiceRolePolicy` managed policy for the service linked role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams) to add the permissions that are required when an administrator enables a stream for a table. Amazon Keyspaces uses the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish CloudWatch metrics into your account on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](./using-service-linked-roles-CDC-streams.html). | July 02, 2025 @@ -106,2 +133,2 @@ AmazonKeyspacesFullAccess – Update to an existing policy | Amazon Keyspaces a -AmazonKeyspacesReadOnlyAccess – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics and dimensions](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022 -AmazonKeyspacesFullAccess – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics and dimensions](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022 +AmazonKeyspacesReadOnlyAccess – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022 +AmazonKeyspacesFullAccess – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics](./metrics-dimensions.html#keyspaces-metrics-dimensions). | July 7, 2022