AWS datazone low security documentation change
Summary
Replaced detailed inline IAM policy JSON with a reference to AWS Managed Policy documentation
Security assessment
The change removes explicit permissions documentation which could lead to security risks if outdated. By centralizing policy references, AWS ensures users always check the current managed policy, reducing the risk of misconfiguration. However, there's no evidence this addresses an active security vulnerability.
Diff
diff --git a/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneEnvironmentRolePermissionsBoundary.md b/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneEnvironmentRolePermissionsBoundary.md index 2eb913cf1..54b696d3e 100644 --- a//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneEnvironmentRolePermissionsBoundary.md +++ b//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneEnvironmentRolePermissionsBoundary.md @@ -19,562 +19 @@ Amazon DataZone applies the `AmazonDataZoneEnvironmentRolePermissionsBoundary` A -The boundary includes the following JSON statements: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "CreateGlueConnection", - "Effect": "Allow", - "Action": [ - "ec2:CreateTags", - "ec2:DeleteTags" - ], - "Resource": [ - "arn:aws:ec2:*:*:network-interface/*" - ], - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws-glue-service-resource" - ] - } - } - }, - { - "Sid": "GlueOperations", - "Effect": "Allow", - "Action": [ - "glue:*DataQuality*", - "glue:BatchCreatePartition", - "glue:BatchDeleteConnection", - "glue:BatchDeletePartition", - "glue:BatchDeleteTable", - "glue:BatchDeleteTableVersion", - "glue:BatchGetJobs", - "glue:BatchGetWorkflows", - "glue:BatchStopJobRun", - "glue:BatchUpdatePartition", - "glue:CreateBlueprint", - "glue:CreateConnection", - "glue:CreateCrawler", - "glue:CreateDatabase", - "glue:CreateJob", - "glue:CreatePartition", - "glue:CreatePartitionIndex", - "glue:CreateTable", - "glue:CreateWorkflow", - "glue:DeleteBlueprint", - "glue:DeleteColumnStatisticsForPartition", - "glue:DeleteColumnStatisticsForTable", - "glue:DeleteConnection", - "glue:DeleteCrawler", - "glue:DeleteJob", - "glue:DeletePartition", - "glue:DeletePartitionIndex", - "glue:DeleteTable", - "glue:DeleteTableVersion", - "glue:DeleteWorkflow", - "glue:GetColumnStatisticsForPartition", - "glue:GetColumnStatisticsForTable", - "glue:GetConnection", - "glue:GetDatabase", - "glue:GetDatabases", - "glue:GetTable", - "glue:GetTables", - "glue:GetPartition", - "glue:GetPartitions", - "glue:ListSchemas", - "glue:ListJobs", - "glue:NotifyEvent", - "glue:PutWorkflowRunProperties", - "glue:ResetJobBookmark", - "glue:ResumeWorkflowRun", - "glue:SearchTables", - "glue:StartBlueprintRun", - "glue:StartCrawler", - "glue:StartCrawlerSchedule", - "glue:StartJobRun", - "glue:StartWorkflowRun", - "glue:StopCrawler", - "glue:StopCrawlerSchedule", - "glue:StopWorkflowRun", - "glue:UpdateBlueprint", - "glue:UpdateColumnStatisticsForPartition", - "glue:UpdateColumnStatisticsForTable", - "glue:UpdateConnection", - "glue:UpdateCrawler", - "glue:UpdateCrawlerSchedule", - "glue:UpdateDatabase", - "glue:UpdateJob", - "glue:UpdatePartition", - "glue:UpdateTable", - "glue:UpdateWorkflow" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws:ResourceTag/AmazonDataZoneEnvironment": "false" - } - } - }, - { - "Sid": "PassRole", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": [ - "arn:aws:iam::*:role/datazone*" - ], - "Condition": { - "StringEquals": { - "iam:PassedToService": "glue.amazonaws.com" - } - } - }, - { - "Sid": "SameAccountKmsOperations", - "Effect": "Allow", - "Action": [ - "kms:DescribeKey", - "kms:Decrypt", - "kms:ListKeys" - ], - "Resource": "*", - "Condition": { - "StringNotEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "KmsOperationsWithResourceTag", - "Effect": "Allow", - "Action": [ - "kms:DescribeKey", - "kms:Decrypt", - "kms:ListKeys", - "kms:Encrypt", - "kms:GenerateDataKey", - "kms:Verify", - "kms:Sign" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws:ResourceTag/AmazonDataZoneEnvironment": "false" - } - } - }, - { - "Sid": "AnalyticsOperations", - "Effect": "Allow", - "Action": [ - "datazone:*", - "sqlworkbench:*" - ], - "Resource": "*" - }, - { - "Sid": "QueryOperations", - "Effect": "Allow", - "Action": [ - "athena:BatchGetNamedQuery", - "athena:BatchGetPreparedStatement", - "athena:BatchGetQueryExecution", - "athena:CreateNamedQuery", - "athena:CreateNotebook", - "athena:CreatePreparedStatement", - "athena:CreatePresignedNotebookUrl", - "athena:DeleteNamedQuery", - "athena:DeleteNotebook", - "athena:DeletePreparedStatement", - "athena:ExportNotebook", - "athena:GetDatabase", - "athena:GetDataCatalog", - "athena:GetNamedQuery", - "athena:GetPreparedStatement", - "athena:GetQueryExecution", - "athena:GetQueryResults", - "athena:GetQueryRuntimeStatistics", - "athena:GetTableMetadata", - "athena:GetWorkGroup", - "athena:ImportNotebook", - "athena:ListDatabases", - "athena:ListDataCatalogs", - "athena:ListEngineVersions", - "athena:ListNamedQueries", - "athena:ListPreparedStatements", - "athena:ListQueryExecutions", - "athena:ListTableMetadata", - "athena:ListTagsForResource", - "athena:ListWorkGroups", - "athena:StartCalculationExecution", - "athena:StartQueryExecution",