AWS singlesignon documentation change
Summary
Updated CloudTrail log examples to clarify user types (IAM user vs IdentityCenterUser) and removed email addresses from userIdentity fields
Security assessment
Changes improve logging documentation accuracy by distinguishing between IAM users and Identity Center users, but there's no evidence of addressing a specific vulnerability. The removal of email addresses from examples demonstrates security-conscious documentation practices.
Diff
diff --git a/singlesignon/latest/userguide/understanding-sso-entries.md b/singlesignon/latest/userguide/understanding-sso-entries.md index e447aeffe..2727ccec3 100644 --- a//singlesignon/latest/userguide/understanding-sso-entries.md +++ b//singlesignon/latest/userguide/understanding-sso-entries.md @@ -9 +9 @@ A trail is a configuration that enables delivery of events to an Amazon S3 bucke -The following example shows a CloudTrail log entry for an administrator ([email protected]) that took place in the IAM Identity Center console: +This example demonstrates a CloudTrail log entry capturing a `DescribePermissionsPolicies` action performed by an IAM user (samadams) interacting with IAM Identity Center: @@ -46 +46 @@ The following example shows a CloudTrail log entry for an administrator (samadam -The following example shows a CloudTrail log entry for an end-user ([email protected]) action that took place in the AWS access portal: +This example demonstrates a CloudTrail log entry capturing a `ListApplications` action performed by an IAM Identity Center user within the AWS access portal: @@ -54,2 +54 @@ The following example shows a CloudTrail log entry for an end-user (bobsmith@exa - "type":"Unknown", - "principalId":"example.com//S-1-5-21-1122334455-3652759393-4233131409-1126", + "type":"IdentityCenterUser", @@ -57 +55,0 @@ The following example shows a CloudTrail log entry for an end-user (bobsmith@exa - "userName":"[email protected]", @@ -80 +78 @@ The following example shows a CloudTrail log entry for an end-user (bobsmith@exa -The following example shows a CloudTrail log entry for an end-user ([email protected]) action that took place in IAM Identity Center OIDC: +This example demonstrates a CloudTrail log entry capturing a `CreateToken` action performed by an IAM Identity Center user authenticating with the IAM Identity Center OIDC service: @@ -86,2 +84 @@ The following example shows a CloudTrail log entry for an end-user (bobsmith@exa - "type": "Unknown", - "principalId": "example.com//S-1-5-21-1122334455-3652759393-4233131409-1126", + "type": "IdentityCenterUser", @@ -89 +85,0 @@ The following example shows a CloudTrail log entry for an end-user (bobsmith@exa - "userName": "[email protected]",