AWS network-manager documentation change

Service: network-manager · 2025-07-18 · Documentation low

File: network-manager/latest/tgwnm/nm-security-iam.md

Summary

Added multiple JSON policy examples and expanded documentation

Security assessment

Significantly enhances IAM policy documentation with concrete examples but doesn't address specific vulnerabilities

Diff

diff --git a/network-manager/latest/tgwnm/nm-security-iam.md b/network-manager/latest/tgwnm/nm-security-iam.md
index d1a7bd60d..88328571d 100644
--- a//network-manager/latest/tgwnm/nm-security-iam.md
+++ b//network-manager/latest/tgwnm/nm-security-iam.md
@@ -97,0 +98,6 @@ The following IAM policy grants full access to the Amazon EC2, global networks,
+JSON
+    
+
+****
+    
+    
@@ -138,0 +146,6 @@ The following IAM policy grants read-only access to the Amazon EC2, global netwo
+JSON
+    
+
+****
+    
+    
@@ -197,0 +211,46 @@ The following IAM policy grants read-only access to the Amazon EC2, global netwo
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "networkmanager:CreateSite"
+                ],
+                "Resource": [
+                    "arn:aws:networkmanager::account-id:global-network/global-network-1122334455aabbccd",
+                    "arn:aws:networkmanager::account-id:site/*"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "networkmanager:CreateDevice"
+                ],
+                "Resource": [
+                    "arn:aws:networkmanager::account-id:global-network/global-network-1122334455aabbccd",
+                    "arn:aws:networkmanager::account-id:site/*",
+                    "arn:aws:networkmanager::account-id:device/*"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "networkmanager:CreateLink"
+                ],
+                "Resource": [
+                    "arn:aws:networkmanager::account-id:global-network/global-network-1122334455aabbccd",
+                    "arn:aws:networkmanager::account-id:link/*"
+                ]
+            }
+        ]
+    }
+    
+
@@ -210,0 +270,6 @@ The policy uses the `networkmanager:tgwArn` and `networkmanager:cgwArn` conditio
+JSON
+    
+
+****
+    
+