AWS simspaceweaver high security documentation change

Service: simspaceweaver · 2025-07-16 · Security-related high

File: simspaceweaver/1.16/userguide/cross-service-confused-deputy-prevention.md

Summary

Modified IAM policy examples for confused deputy prevention - removed service name from ARNs and Principal entries

Security assessment

Changes correct IAM policy syntax for proper confused deputy protection by fixing ARN formats and principal entries. Incorrect ARNs could lead to security vulnerabilities by allowing unintended access.

Diff

diff --git a/simspaceweaver/1.16/userguide/cross-service-confused-deputy-prevention.md b/simspaceweaver/1.16/userguide/cross-service-confused-deputy-prevention.md
index b76f76f04..c7c387292 100644
--- a//simspaceweaver/1.16/userguide/cross-service-confused-deputy-prevention.md
+++ b//simspaceweaver/1.16/userguide/cross-service-confused-deputy-prevention.md
@@ -18,0 +19,6 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
+JSON
+    
+
+****
+    
+    
@@ -27 +33 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -36 +42 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/*"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/*"
@@ -44,0 +52,6 @@ A more secure way to write this policy is to include the simulation name in the
+JSON
+    
+
+****
+    
+    
@@ -53 +66 @@ A more secure way to write this policy is to include the simulation name in the
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -62 +75 @@ A more secure way to write this policy is to include the simulation name in the
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/MyProjectSimulation_22-10-04_22_10_15"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/"
@@ -70,0 +85,6 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
+JSON
+    
+
+****
+    
+    
@@ -79 +99 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -85 +105 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/MyProjectSimulation_22-10-04_22_10_15"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/"