AWS res medium security documentation change
Summary
Updated IAM role configuration requirements and component parameters for RES-ready AMI creation. Added explicit S3 bucket owner validation, narrowed IAM policy permissions, and introduced versioned script references.
Security assessment
Added requirement for 'expectedBucketOwner' field enforces S3 bucket ownership validation. The IAM policy was narrowed from multiple S3 resources to a single environment-specific path, reducing attack surface. A new custom RES policy with limited DynamoDB/S3 access was added, demonstrating principle of least privilege. These changes directly impact access control and resource isolation security mechanisms.
Diff
diff --git a/res/latest/ug/res-ready-ami.md b/res/latest/ug/res-ready-ami.md similarity index 69% rename from /root/aws-docs-changes/docs/2025-07-18_11-39-58/res/latest/ug/res-ready-ami.md rename to /root/aws-docs-changes/docs/2025-07-19_00-00-04/res/archive/release-minus-4/ug/res-ready-ami.md index 9589f37f6..ca71300de 100644 --- a//res/latest/ug/res-ready-ami.md +++ b//res/archive/release-minus-4/ug/res-ready-ami.md @@ -1 +1 @@ -[](/pdfs/res/latest/ug/res-ug.pdf#res-ready-ami "Open PDF") +[](/pdfs/res/archive/release-minus-4/ug/res-ug.pdf#res-ready-ami "Open PDF") @@ -5 +5 @@ -Prepare an IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES +Prepare IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES @@ -9 +9 @@ Prepare an IAM role to access RES environmentCreate EC2 Image Builder componentP -With RES-ready Amazon Machine Images (AMIs), you can pre-install RES dependencies for virtual desktop instances (VDIs) on your custom AMIs. Using RES-ready AMIs improve boot times for VDI instances using the pre-baked images. Using EC2 Image Builder, you can build and register your AMIs as new software stacks. For more information on Image Builder, see the [ Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html). +With RES-ready AMIs, you can pre-install RES dependencies for virtual desktop instances (VDIs) on your custom AMIs. Using RES-ready AMIs improve boot times for VDI instances using the pre-baked images. Using EC2 Image Builder, you can build and register your AMIs as new software stacks. For more information on Image Builder, see the [Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html). @@ -15 +15 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ - * Prepare an IAM role to access RES environment + * Prepare IAM role to access RES environment @@ -32 +32 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ -## Prepare an IAM role to access RES environment +## Prepare IAM role to access RES environment @@ -38 +38 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Trusted relationships that include the Amazon EC2 service. + * Trusted relationships include the Amazon EC2 service @@ -40 +40 @@ To access the RES environment service from EC2 Image Builder, you must create or - * AmazonS3ReadOnlyAccess, AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. + * AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies @@ -41,0 +42 @@ To access the RES environment service from EC2 Image Builder, you must create or + * Custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment @@ -42,0 +44 @@ To access the RES environment service from EC2 Image Builder, you must create or +(This policy can be either a customer managed or customer inline policy document.) @@ -45 +46,0 @@ To access the RES environment service from EC2 Image Builder, you must create or - 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** @@ -47 +47,0 @@ To access the RES environment service from EC2 Image Builder, you must create or - 2. Select **JSON** from the policy editor. @@ -49,3 +49 @@ To access the RES environment service from EC2 Image Builder, you must create or - 3. Copy and paste the policy shown here into the editor, replacing your desired `{AWS-Region}`, `{AWS-Account-ID}`, and `{RES-EnvironmentName}` where applicable. - -**RES policy:** +**Trusted relationship entity:** @@ -53 +50,0 @@ To access the RES environment service from EC2 Image Builder, you must create or -JSON @@ -54,0 +52,12 @@ JSON + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + } + "Action": "sts:AssumeRole" + } + ] + } @@ -56 +65 @@ JSON -**** +**RES policy:** @@ -71,3 +80 @@ JSON - "global-settings.package_config.*", - "cluster-manager.host_modules.*", - "identity-provider.cognito.enable_native_user_login" + "global-settings.package_config.*" @@ -82,4 +89 @@ JSON - "Resource": [ - "arn:aws:s3:::{RES-EnvironmentName}-cluster-{AWS-Region}-{AWS-Account-ID}/idea/vdc/res-ready-install-script-packages/*", - "arn:aws:s3:::research-engineering-studio-{AWS-Region}/host_modules/*" - ] + "Resource": "arn:aws:s3:::{RES-EnvironmentName}-cluster-{AWS-Region}-{AWS-Account-ID}/idea/vdc/res-ready-install-script-packages/*" @@ -90,42 +93,0 @@ JSON - - 4. Choose **Next** and provide a name and optional description to complete the policy creation. - - 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. - - 6. Under **Trusted Entity Type** , select **"AWS service"**. - - 7. Select **EC2** in the **Service or use case** drop down. - - 8. In the **Use case** section, select **EC2** , then choose **Next**. - - 9. Search for and then select the name of the policy you previously created. - - 10. Choose **Next** and provide a name and optional description to complete the role creation. - - 11. Select your new role and verify that the Trust relationship matches the following: - -**Trusted relationship entity:** - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - - - - - @@ -163,0 +126,13 @@ Linux + parameters: + - AWSAccountID: + type: string + description: RES Environment AWS Account ID + - RESEnvName: + type: string + description: RES Environment Name + - RESEnvRegion: + type: string + description: RES Environment Region + - RESEnvReleaseVersion: + type: string + description: RES Release Version @@ -181,2 +156,3 @@ Linux - - source: 's3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz' - destination: '/root/bootstrap/res-installation-scripts/res-installation-scripts.tar.gz' + - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/linux/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' + destination: '/root/bootstrap/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' + expectedBucketOwner: '{{ AWSAccountID }}' @@ -189,4 +165,8 @@ Linux - - 'cd /root/bootstrap/res-installation-scripts' - - 'tar -xf res-installation-scripts.tar.gz' - - 'cd scripts/virtual-desktop-host/linux' - - '/bin/bash install.sh -g NONE' + - 'tar -xvf {{ build.DownloadRESLinuxInstallPackage.inputs[0].destination }} -C /root/bootstrap/latest' + - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install.sh -r {{ RESEnvRegion }} -n {{ RESEnvName }} -g NONE' + - name: FirstReboot + action: Reboot + onFailure: Abort + maxAttempts: 3 + inputs: + delaySeconds: 0 @@ -199,4 +179,3 @@ Linux - - 'cd /root/bootstrap/res-installation-scripts/scripts/virtual-desktop-host/linux' - - '/bin/bash install_post_reboot.sh -g NONE' - - name: PreventAL2023FromUninstallingCronie - action: ExecuteBash + - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install_post_reboot.sh' + - name: SecondReboot + action: Reboot @@ -206,2 +185 @@ Linux - commands: - - 'rm -f /tmp/imagebuilder_service/crontab_installed' + delaySeconds: 0 @@ -224,0 +203,13 @@ Windows + parameters: + - AWSAccountID: + type: string + description: RES Environment AWS Account ID + - RESEnvName: + type: string + description: RES Environment Name + - RESEnvRegion: + type: string + description: RES Environment Region + - RESEnvReleaseVersion: + type: string + description: RES Release Version @@ -241,2 +232,3 @@ Windows - - source: 's3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz' - destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res-installation-scripts.tar.gz' + - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/windows/res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' + destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' + expectedBucketOwner: '{{ AWSAccountID }}' @@ -250,3 +242,9 @@ Windows - - 'tar -xf res-installation-scripts.tar.gz' - - 'Import-Module .\scripts\virtual-desktop-host\windows\Install.ps1' - - 'Install-WindowsEC2Instance -PrebakeAMI' + - 'Tar -xf res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' + - 'Import-Module .\virtual-desktop-host-windows\Install.ps1' + - 'Install-WindowsEC2Instance' + - name: Reboot + action: Reboot + onFailure: Abort + maxAttempts: 3 + inputs: + delaySeconds: 0 @@ -267,6 +264,0 @@ RES supports the following image operating systems: - * Amazon Linux 2023 (x86 and ARM64) - - * RHEL 8 (x86), and 9 (x86) - - * Rocky Linux 9 (x86) - @@ -275,3 +267 @@ RES supports the following image operating systems: - * Windows Server 2019, 2022 (x86)