AWS singlesignon documentation change
Summary
Updated documentation for sign-in event examples with improved terminology, clarified authentication scenarios, and corrected CloudTrail event structure examples. Changes include standardizing 'password only' phrasing, expanding TOTP acronym, adding security analysis context, and updating principal type in JSON examples from 'Unknown' to 'IdentityCenterUser'.
Security assessment
The changes improve documentation clarity around authentication events and security monitoring capabilities but do not address any specific security vulnerability. The updates to principal type in event examples (from 'Unknown' to 'IdentityCenterUser') enhance audit log accuracy, which helps with security investigations but doesn't fix a vulnerability. The added text about 'identify security issues' strengthens security documentation.
Diff
diff --git a/singlesignon/latest/userguide/sign-in-events-examples.md b/singlesignon/latest/userguide/sign-in-events-examples.md index ff274a85e..51e8c4363 100644 --- a//singlesignon/latest/userguide/sign-in-events-examples.md +++ b//singlesignon/latest/userguide/sign-in-events-examples.md @@ -5 +5 @@ -Successful sign-in when authenticating with only a passwordSuccessful sign-in when authenticating with an external identity providerSuccessful sign-in when authenticating with a password and a TOTP authenticator appSuccessful sign-in when authenticating with a password and forced MFA registration is requiredFailed sign-in when authenticating with only a password +Successful sign-in when authenticating with password onlySuccessful sign-in when authenticating with an external identity providerSuccessful sign-in when authenticating with a password and a TOTP authenticator appSuccessful sign-in when authenticating with a password and forced MFA registration is requiredFailed sign-in due to incorrect password authentication @@ -9 +9 @@ Successful sign-in when authenticating with only a passwordSuccessful sign-in wh -The following examples show the expected sequence of CloudTrail events for different sign-in scenarios. +The following examples illustrate the typical CloudTrail event sequences generated during various AWS sign-in scenarios. These examples serve as reference patterns to help you interpret authentication logs, identify security issues, and verify that your authentication policies are functioning correctly. @@ -13 +13 @@ The following examples show the expected sequence of CloudTrail events for diffe - * Successful sign-in when authenticating with only a password + * Successful sign-in when authenticating with password only @@ -17 +17 @@ The following examples show the expected sequence of CloudTrail events for diffe - * Successful sign-in when authenticating with a password and a TOTP authenticator app + * Successful sign-in when authenticating with a password and a time-based one-time password (TOTP) authenticator app @@ -21 +21 @@ The following examples show the expected sequence of CloudTrail events for diffe - * Failed sign-in when authenticating with only a password + * Failed sign-in due to incorrect password authentication @@ -26 +26 @@ The following examples show the expected sequence of CloudTrail events for diffe -## Successful sign-in when authenticating with only a password +## Successful sign-in when authenticating with password only @@ -36,2 +36 @@ The following sequence of events captures an example of a successful password on - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -41 +39,0 @@ The following sequence of events captures an example of a successful password on - "userName":"[email protected]", @@ -78,2 +76 @@ The following sequence of events captures an example of a successful password on - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -83 +79,0 @@ The following sequence of events captures an example of a successful password on - "userName":"[email protected]", @@ -120,2 +116 @@ The following sequence of events captures an example of a successful password on - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -125 +119,0 @@ The following sequence of events captures an example of a successful password on - "userName":"[email protected]", @@ -167,2 +161 @@ The following sequence of events captures an example of a successful sign-in whe - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -204 +197 @@ The following sequence of events captures an example of a successful sign-in whe -## Successful sign-in when authenticating with a password and a TOTP authenticator app +## Successful sign-in when authenticating with a password and a time-based one-time password (TOTP) authenticator app @@ -214,2 +207 @@ The following sequence of events captures an example where multi-factor authenti - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -219 +210,0 @@ The following sequence of events captures an example where multi-factor authenti - "userName":"[email protected]", @@ -257,2 +248 @@ The following sequence of events captures an example where multi-factor authenti - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -262 +251,0 @@ The following sequence of events captures an example where multi-factor authenti - "userName":"[email protected]", @@ -299,2 +288 @@ The following sequence of events captures an example where multi-factor authenti - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -304 +291,0 @@ The following sequence of events captures an example where multi-factor authenti - "userName":"[email protected]", @@ -341,2 +328 @@ The following sequence of events captures an example where multi-factor authenti - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -346 +331,0 @@ The following sequence of events captures an example where multi-factor authenti - "userName":"[email protected]", @@ -383,2 +368 @@ The following sequence of events captures an example where multi-factor authenti - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -388 +371,0 @@ The following sequence of events captures an example where multi-factor authenti - "userName":"[email protected]", @@ -422 +405 @@ The following sequence of events captures an example where multi-factor authenti -The following sequence of events captures an example of a successful password sign in, but the user was required and successfully completed registering an MFA device before completing their sign-in. +The following sequence of events demonstrates a successful password authentication where the user was required to register and successfully complete multi-factor authentication (MFA) before finalizing their sign-in process. @@ -430,2 +413 @@ The following sequence of events captures an example of a successful password si - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -435 +416,0 @@ The following sequence of events captures an example of a successful password si - "userName":"[email protected]", @@ -473,2 +454 @@ The following sequence of events captures an example of a successful password si - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -478 +457,0 @@ The following sequence of events captures an example of a successful password si - "userName":"[email protected]", @@ -515,2 +494 @@ The following sequence of events captures an example of a successful password si - "type":"Unknown", - "principalId":"111122223333", + "type":"IdentityCenterUser", @@ -520 +497,0 @@ The following sequence of events captures an example of a successful password si - "userName":"[email protected]", @@ -553 +530 @@ The following sequence of events captures an example of a successful password si -## Failed sign-in when authenticating with only a password +## Failed sign-in due to incorrect password authentication @@ -555 +532 @@ The following sequence of events captures an example of a successful password si -The following sequence of events captures an example of a failed password only sign-in. +The following sequence of events demonstrates an authentication attempt where the user successfully entered their username but failed the password verification step, resulting in an unsuccessful sign-in. @@ -564 +540,0 @@ The following sequence of events captures an example of a failed password only s - "principalId":"111122223333", @@ -568 +543,0 @@ The following sequence of events captures an example of a failed password only s - "userName":"[email protected]", @@ -602 +576,0 @@ The following sequence of events captures an example of a failed password only s - "principalId":"111122223333", @@ -606 +579,0 @@ The following sequence of events captures an example of a failed password only s - "userName":"[email protected]",