AWS simspaceweaver high security documentation change

Service: simspaceweaver · 2025-07-16 · Security-related high

File: simspaceweaver/1.15/userguide/cross-service-confused-deputy-prevention.md

Summary

Revised IAM policy examples for confused deputy prevention, including ARN format adjustments and principal changes

Security assessment

Corrects policy examples to enforce stricter resource restrictions, mitigating potential confused deputy attacks by refining ARN patterns and principal conditions.

Diff

diff --git a/simspaceweaver/1.15/userguide/cross-service-confused-deputy-prevention.md b/simspaceweaver/1.15/userguide/cross-service-confused-deputy-prevention.md
index 2376000c7..b437a0930 100644
--- a//simspaceweaver/1.15/userguide/cross-service-confused-deputy-prevention.md
+++ b//simspaceweaver/1.15/userguide/cross-service-confused-deputy-prevention.md
@@ -18,0 +19,6 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
+JSON
+    
+
+****
+    
+    
@@ -27 +33 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -36 +42 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/*"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/*"
@@ -44,0 +52,6 @@ A more secure way to write this policy is to include the simulation name in the
+JSON
+    
+
+****
+    
+    
@@ -53 +66 @@ A more secure way to write this policy is to include the simulation name in the
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -62 +75 @@ A more secure way to write this policy is to include the simulation name in the
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/MyProjectSimulation_22-10-04_22_10_15"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/"
@@ -70,0 +85,6 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
+JSON
+    
+
+****
+    
+    
@@ -79 +99 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -85 +105 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/MyProjectSimulation_22-10-04_22_10_15"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/"