AWS organizations documentation change
Summary
Removed detailed JSON policies and replaced with code block markers, restructured delegation policy examples
Security assessment
Restructured resource-based policy documentation without changing security content. Maintains security documentation but doesn't add new security features or address vulnerabilities.
Diff
diff --git a/organizations/latest/userguide/security_iam_resource-based-policy-examples.md b/organizations/latest/userguide/security_iam_resource-based-policy-examples.md index 8caeaa6cd..2a29597e8 100644 --- a//organizations/latest/userguide/security_iam_resource-based-policy-examples.md +++ b//organizations/latest/userguide/security_iam_resource-based-policy-examples.md @@ -37,0 +38,6 @@ This example delegation policy grants the permissions necessary to complete acti +JSON + + +**** + + @@ -83,53 +89,0 @@ This example delegation policy grants the permissions necessary to complete acti - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DelegatingNecessaryDescribeListActions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::MemberAccountId:root" - }, - "Action": [ - "organizations:DescribeOrganization", - "organizations:DescribeOrganizationalUnit", - "organizations:DescribeAccount", - "organizations:DescribePolicy", - "organizations:DescribeEffectivePolicy", - "organizations:ListRoots", - "organizations:ListOrganizationalUnitsForParent", - "organizations:ListParents", - "organizations:ListChildren", - "organizations:ListAccounts", - "organizations:ListAccountsForParent", - "organizations:ListPolicies", - "organizations:ListPoliciesForTarget", - "organizations:ListTargetsForPolicy", - "organizations:ListTagsForResource" - ], - "Resource": "*", - "Condition": { - "StringLikeIfExists": { - "organizations:PolicyType": "SERVICE_CONTROL_POLICY" - } - } - }, - { - "Sid": "DelegatingMinimalActionsForSCPs", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::MemberAccountId:root" - }, - "Action": [ - "organizations:CreatePolicy", - "organizations:DescribePolicy", - "organizations:UpdatePolicy", - "organizations:DeletePolicy" - ], - "Resource": [ - "arn:aws:organizations::ManagementAccountId:policy/o-OrganizationId/service_control_policy/*", - "arn:aws:organizations::aws:policy/service_control_policy/*" - ] - } - ] - } - @@ -143,48 +96,0 @@ To use this delegation policy, replace the AWS placeholder text for `MemberAccou - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DelegatingNecessaryDescribeListActions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::MemberAccountId:root" - }, - "Action": [ - "organizations:DescribeOrganization", - "organizations:DescribeOrganizationalUnit", - "organizations:DescribeAccount", - "organizations:DescribePolicy", - "organizations:DescribeEffectivePolicy", - "organizations:ListRoots", - "organizations:ListOrganizationalUnitsForParent", - "organizations:ListParents", - "organizations:ListChildren", - "organizations:ListAccounts", - "organizations:ListAccountsForParent", - "organizations:ListPolicies", - "organizations:ListPoliciesForTarget", - "organizations:ListTargetsForPolicy", - "organizations:ListTagsForResource" - ], - "Resource": "*", - "Condition": { - "StringLikeIfExists": { - "organizations:PolicyType": "BACKUP_POLICY" - } - } - }, - { - "Sid": "DelegatingTaggingBackupPolicies", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::MemberAccountId:root" - }, - "Action": [ - "organizations:TagResource", - "organizations:UntagResource" - ], - "Resource": "arn:aws:organizations::ManagementAccountId:policy/o-OrganizationId/backup_policy/*" - } - ] - } - @@ -207,47 +112,0 @@ This example delegation policy grants the permissions necessary to complete acti - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DelegatingNecessaryDescribeListActions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::MemberAccountId:root" - }, - "Action": [ - "organizations:DescribeOrganization", - "organizations:DescribeOrganizationalUnit", - "organizations:DescribeAccount", - "organizations:DescribePolicy", - "organizations:DescribeEffectivePolicy", - "organizations:ListRoots", - "organizations:ListOrganizationalUnitsForParent", - "organizations:ListParents", - "organizations:ListChildren", - "organizations:ListAccounts", - "organizations:ListAccountsForParent", - "organizations:ListPolicies", - "organizations:ListPoliciesForTarget", - "organizations:ListTargetsForPolicy", - "organizations:ListTagsForResource" - ], - "Resource": "*" - }, - { - "Sid": "AttachDetachPoliciesSpecifiedAccountOU", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::MemberAccountId:root" - }, - "Action": [ - "organizations:AttachPolicy", - "organizations:DetachPolicy" - ], - "Resource": [ - "arn:aws:organizations::ManagementAccountId:ou/o-OrganizationId/ou-OUId", - "arn:aws:organizations::ManagementAccountId:account/o-OrganizationId/TargetAccountId", - "arn:aws:organizations::ManagementAccountId:policy/o-OrganizationId/backup_policy/*" - ] - } - ] - } - @@ -273,0 +133,6 @@ This example delegation policy grants the permissions necessary to complete acti +JSON + + +**** + +