AWS simspaceweaver high security documentation change

Service: simspaceweaver · 2025-07-16 · Security-related high

File: simspaceweaver/latest/userguide/cross-service-confused-deputy-prevention.md

Summary

Modified IAM policy examples for confused deputy prevention - removed service name from ARNs and Principal entries

Security assessment

Updates to security-focused IAM policies addressing confused deputy risks through corrected ARN formats and principal configuration. Essential for proper access control.

Diff

diff --git a/simspaceweaver/latest/userguide/cross-service-confused-deputy-prevention.md b/simspaceweaver/latest/userguide/cross-service-confused-deputy-prevention.md
index f9382e362..7d93c38bc 100644
--- a//simspaceweaver/latest/userguide/cross-service-confused-deputy-prevention.md
+++ b//simspaceweaver/latest/userguide/cross-service-confused-deputy-prevention.md
@@ -18,0 +19,6 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
+JSON
+    
+
+****
+    
+    
@@ -27 +33 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -36 +42 @@ The following example shows how you can use the `aws:SourceArn` and `aws:SourceA
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/*"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/*"
@@ -44,0 +52,6 @@ A more secure way to write this policy is to include the simulation name in the
+JSON
+    
+
+****
+    
+    
@@ -53 +66 @@ A more secure way to write this policy is to include the simulation name in the
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -62 +75 @@ A more secure way to write this policy is to include the simulation name in the
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/MyProjectSimulation_22-10-04_22_10_15"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/"
@@ -70,0 +85,6 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
+JSON
+    
+
+****
+    
+    
@@ -79 +99 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
-              "simspaceweaver.amazonaws.com"
+              ""
@@ -85 +105 @@ When your `aws:SourceArn` explicitly includes an account number, you can leave o
-              "aws:SourceArn": "arn:aws:simspaceweaver:us-west-2:111122223333:simulation/MyProjectSimulation_22-10-04_22_10_15"
+              "aws:SourceArn": "arn:aws:::111122223333:simulation/"