AWS IAM documentation change
Summary
Updated resource-based policy documentation links for multiple AWS services and added AWS Shield network security director entry. Expanded S3 tag-based authorization documentation.
Security assessment
Changes primarily add/update links to resource-based policy documentation and expand authorization examples. While these relate to security features, there's no evidence of addressing specific vulnerabilities. The updates improve documentation clarity for existing security controls.
Diff
diff --git a/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.md b/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.md index d241360b5..6f9d06c96 100644 --- a//IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.md +++ b//IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.md @@ -41 +41 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.html) | Yes | Yes | Yes | No | Yes | [Yes](https://docs.aws.amazon.com/apigateway/latest/developerguide/using-service-linked-roles.html) +[Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html) | No | Yes | [Yes](https://docs.aws.amazon.com/apigateway/latest/developerguide/using-service-linked-roles.html) @@ -68 +68 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/security-considerations.html) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/aws-backup/latest/devguide/using-service-linked-roles.html) +[AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/security-considerations.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/aws-backup/latest/devguide/create-a-vault-access-policy.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/aws-backup/latest/devguide/using-service-linked-roles.html) @@ -87 +87 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Cloud9](https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/cloud9/latest/user-guide/using-service-linked-roles.html) +[AWS Cloud9](https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#security_iam_access-manage) | Yes | Yes | [Yes](https://docs.aws.amazon.com/cloud9/latest/user-guide/using-service-linked-roles.html) @@ -104 +104 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/auth-and-access-control-cwl.html) | Yes | Yes | Yes | [Partial](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.html) | Yes | [Yes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/using-service-linked-roles-cwl.html) +[Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/auth-and-access-control-cwl.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html#resource-based-policies-cwl) | [Partial](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.html) | Yes | [Yes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/using-service-linked-roles-cwl.html) @@ -141 +141 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Cost Explorer](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-what-is.html) | Yes | Yes | Yes | Yes | Yes | No +[AWS Cost Explorer](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-what-is.html) | Yes | Yes | No | Yes | Yes | No @@ -163 +163 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/UsingIAMWithDDB.html) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-roles-service-linked) +[Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/UsingIAMWithDDB.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-roles-service-linked) @@ -170 +170 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon Elastic Container Registry (Amazon ECR)](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam.html) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonECR/latest/userguide/using-service-linked-roles.html) +[Amazon Elastic Container Registry (Amazon ECR)](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonECR/latest/userguide/using-service-linked-roles.html) @@ -174 +174 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon Elastic File System (Amazon EFS)](https://docs.aws.amazon.com/efs/latest/ug/security-considerations.html) | Yes | Yes | Yes | [Partial](https://docs.aws.amazon.com/efs/latest/ug/using-tags-efs.html) | Yes | [Yes](https://docs.aws.amazon.com/efs/latest/ug/using-service-linked-roles.html) +[Amazon Elastic File System (Amazon EFS)](https://docs.aws.amazon.com/efs/latest/ug/security-considerations.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/efs/latest/ug/security_iam_resource-based-policy-examples.html) | [Partial](https://docs.aws.amazon.com/efs/latest/ug/using-tags-efs.html) | Yes | [Yes](https://docs.aws.amazon.com/efs/latest/ug/using-service-linked-roles.html) @@ -189 +189 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Elemental MediaStore](https://docs.aws.amazon.com/mediastore/latest/ug/setting-up.html) | Yes | Yes | Yes | Yes | Yes | No +[AWS Elemental MediaStore](https://docs.aws.amazon.com/mediastore/latest/ug/setting-up.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/mediastore/latest/ug/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | Yes | Yes | No @@ -198 +198 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Entity Resolution](https://docs.aws.amazon.com/entityresolution/latest/userguide/security-iam.html) | Yes | Yes | Yes | Yes | Yes | No +[AWS Entity Resolution](https://docs.aws.amazon.com/entityresolution/latest/userguide/security-iam.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/entityresolution/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | Yes | Yes | No @@ -216 +216 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/authentication-and-access-control.html) | Yes | Yes | Yes | [Partial](https://docs.aws.amazon.com/glue/latest/dg/monitor-tags.html) | Yes | No +[AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/authentication-and-access-control.html) | Yes | Yes | [Partial](https://docs.aws.amazon.com/glue/latest/dg/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | [Partial](https://docs.aws.amazon.com/glue/latest/dg/monitor-tags.html) | Yes | No @@ -259 +259 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Key Management Service (AWS KMS)](https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/kms/latest/developerguide/using-service-linked-roles.html) +[AWS Key Management Service (AWS KMS)](https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/kms/latest/developerguide/access-glossary.html#security_iam_access-manage) | Yes | Yes | [Yes](https://docs.aws.amazon.com/kms/latest/developerguide/using-service-linked-roles.html) @@ -264 +264 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon Kinesis Data Streams](https://docs.aws.amazon.com/streams/latest/dev/controlling-access.html) | Yes | Yes | Yes | Yes | Yes | No +[Amazon Kinesis Data Streams](https://docs.aws.amazon.com/streams/latest/dev/controlling-access.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/streams/latest/dev/resource-based-policy-examples.html) | Yes | Yes | No @@ -316 +316 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Migration Hub Refactor Spaces](https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/using-service-linked-roles.html) +[AWS Migration Hub Refactor Spaces](https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/) | Yes | Yes | [Yes](https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | Yes | Yes | [Yes](https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/using-service-linked-roles.html) @@ -332 +332 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html) | Yes | Yes | Yes | Yes | Yes | [Yes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/slr.html) +[Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html#ac-types-resource) | Yes | Yes | [Yes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/slr.html) @@ -336 +336 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html) | Yes | Yes | Yes | Yes | No | [Yes](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html#orgs_integrate_services-using_slrs) +[AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/organizations/latest/userguide/security_iam_resource-based-policy-examples.html) | Yes | No | [Yes](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html#orgs_integrate_services-using_slrs) @@ -369 +369 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-serverless.html) | Yes | Yes | Yes | Yes | Yes | No +[Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-serverless.html) | Yes | Yes | Yes (Info) | Yes | Yes | No @@ -387,3 +387,3 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon S3 Express](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-access-overview.html) | Yes | Yes | Yes | Yes | Yes | No -[Amazon S3 Glacier](https://docs.aws.amazon.com/amazonglacier/latest/dev/auth-and-access-control.html) | Yes | Yes | Yes | Yes | Yes | Partial -[Amazon S3 Tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-setting-up.html) | Yes | Yes | Yes | No | Yes | No +[Amazon S3 Express](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-access-overview.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam.html) | Yes | Yes | No +[Amazon S3 Glacier](https://docs.aws.amazon.com/amazonglacier/latest/dev/auth-and-access-control.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/amazonglacier/latest/dev/security_iam_resource-based-policy-examples.html) | Yes | Yes | Partial +[Amazon S3 Tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-setting-up.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-resource-based-policies.html) | No | Yes | No @@ -400 +400 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Serverless Application Repository](https://docs.aws.amazon.com/serverlessrepo/latest/devguide/serverlessrepo-auth-and-access-control.html) | Yes | Yes | Yes | No | Yes | No +[AWS Serverless Application Repository](https://docs.aws.amazon.com/serverlessrepo/latest/devguide/serverlessrepo-auth-and-access-control.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/serverlessrepo/latest/devguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | No | Yes | No @@ -404 +404,2 @@ The AWS services listed below are grouped alphabetically and include information -[AWS Signer](https://docs.aws.amazon.com/signer/latest/developerguide/Welcome.html) | Yes | Yes | Yes | Yes | Yes | No +[AWS Shield network security director](https://docs.aws.amazon.com/waf/latest/developerguide/nsd-security.html) | Yes | No | No | No | Yes | No +[AWS Signer](https://docs.aws.amazon.com/signer/latest/developerguide/Welcome.html) | Yes | Yes | No | Yes | Yes | No @@ -408,4 +409,4 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon Simple Email Service (Amazon SES) v2](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/Welcome.html) | Yes | Partial (Info) | Yes | Yes | Partial (Info) | [Yes](https://docs.aws.amazon.com/ses/latest/dg/using-service-linked-roles.html) -[Amazon Simple Notification Service (Amazon SNS)](https://docs.aws.amazon.com/sns/latest/dg/UsingIAMwithSNS.html) | Yes | Yes | Yes | Yes | Yes | No -[Amazon Simple Queue Service (Amazon SQS)](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/UsingIAM.html) | Yes | Yes | Yes | [Partial](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-abac.html) | Yes | No -[Amazon Simple Storage Service (Amazon S3)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html) | Yes | Yes | Yes | [Partial (Info)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html) | Yes | [Partial (Info)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-service-linked-roles.html) +[Amazon Simple Email Service (Amazon SES) v2](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/Welcome.html) | Yes | Partial (Info) | [Yes](https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-identity-owner-tasks-policy.html) | Yes | Partial (Info) | [Yes](https://docs.aws.amazon.com/ses/latest/dg/using-service-linked-roles.html) +[Amazon Simple Notification Service (Amazon SNS)](https://docs.aws.amazon.com/sns/latest/dg/UsingIAMwithSNS.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sns/latest/dg/security-iam.html#security_iam_service-with-iam-resource-based-policies) | Yes | Yes | No +[Amazon Simple Queue Service (Amazon SQS)](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/UsingIAM.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | [Partial](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-abac.html) | Yes | No +[Amazon Simple Storage Service (Amazon S3)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies) | [Partial (Info)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html) | Yes | [Partial (Info)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-service-linked-roles.html) @@ -413 +414 @@ The AWS services listed below are grouped alphabetically and include information -[Amazon Simple Storage Service (Amazon S3) on AWS Outposts](https://docs.aws.amazon.com/AmazonS3/latest/userguide/S3onOutposts.html) | Yes | Yes | Yes | No | Yes | [Yes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/S3OutpostsServiceLinkedRoles.html) +[Amazon Simple Storage Service (Amazon S3) on AWS Outposts](https://docs.aws.amazon.com/AmazonS3/latest/userguide/S3onOutposts.html) | Yes | Yes | [Yes](https://docs.aws.amazon.com/AmazonS3/latest/s3-outposts/S3OutpostsIAM.html) | No | Yes | [Yes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/S3OutpostsServiceLinkedRoles.html) @@ -547,0 +549,4 @@ AWS Cloud WAN also supports service-linked roles. For more information, see [AWS +### Amazon Redshift Serverless + +Redshift Serverless supports resource-based policies to share snapshots. + @@ -578 +583 @@ Only the Amazon SES API supports temporary security credentials. The Amazon SES -Amazon S3 supports tag-based authorization for only object resources. +Amazon S3 supports tag-based authorization for [directory buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-tagging.html), object resources, [Amazon S3 Storage Lens](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-groups-manage-tags-dashboard.html), and [Storage Lens groups](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-groups-manage-tags.html).