AWS managedservices medium security documentation change

Service: managedservices · 2025-07-04 · Security-related medium

File: managedservices/latest/onboardingguide/defaults-instance-profile.md

Summary

Updated Trend Cloud One Secrets Access and Decryption Key policies to use 'Amazon EC2' full name and corrected KMS key ARN format

Security assessment

The change from a wildcard KMS key ('aws:kms:*:*:key/*') to a specific alias ('arn:aws:kms:*:*:alias/ams/eps/cloudone-migration') tightens permissions, reducing potential over-privileged access. This demonstrates a security best practice by limiting cryptographic operations to a specific resource.

Diff

diff --git a/managedservices/latest/onboardingguide/defaults-instance-profile.md b/managedservices/latest/onboardingguide/defaults-instance-profile.md
index 492412248..805e6d18f 100644
--- a//managedservices/latest/onboardingguide/defaults-instance-profile.md
+++ b//managedservices/latest/onboardingguide/defaults-instance-profile.md
@@ -62 +62 @@ Explicitly Deny List Bucket S3 | Deny | ListBucket | Disallows you listing any e
-Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
+Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows Amazon EC2 to access secrets for Trend Cloud One migration: `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `arn:aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-activation-token*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-id*`, `aws:secretsmanager:*:*:secret:/ams/eps/cloud-one-agent-tenant-guid*`  
@@ -64 +64 @@ Trend Cloud One Secrets Access | Allow | GetSecretValue | Allows EC2 to access s
-Trend Cloud One Decryption Key | Allow | Decrypt | Allow EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `aws:kms:*:*:key/*`  
+Trend Cloud One Decryption Key | Allow | Decrypt | Allow Amazon EC2 to decrypt the AWS KMS key with alias name /ams/eps/cloudone-migration `arn:aws:kms:*:*:alias/ams/eps/cloudone-migration`