AWS snowball documentation change

Service: snowball · 2025-07-19 · Documentation low

File: snowball/latest/developer-guide/access-control-managing-permissions.md

Summary

Added detailed JSON policy examples for Snow Family permissions including S3, Lambda, IAM, EC2, SNS, Greengrass, and Snowball actions

Security assessment

Adds example IAM policies which document security-related permissions but does not indicate a specific security vulnerability being addressed

Diff

diff --git a/snowball/latest/developer-guide/access-control-managing-permissions.md b/snowball/latest/developer-guide/access-control-managing-permissions.md
index be351e01b..b23c63dd4 100644
--- a//snowball/latest/developer-guide/access-control-managing-permissions.md
+++ b//snowball/latest/developer-guide/access-control-managing-permissions.md
@@ -27,0 +28,6 @@ The following shows an example of a permissions policy.
+JSON
+    
+
+****
+    
+    
@@ -70,0 +78,6 @@ To use the AWS Snow Family Management Console, you need to grant permissions for
+JSON
+    
+
+****
+    
+    
@@ -196,0 +210,118 @@ To use the AWS Snow Family Management Console, you need to grant permissions for
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetBucketLocation",
+                    "s3:GetBucketPolicy",
+                    "s3:ListBucket",
+                    "s3:ListBucketMultipartUploads",
+                    "s3:ListAllMyBuckets"
+                ],
+                "Resource": "arn:aws:s3:::*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:CreateBucket",
+                    "s3:PutObject",
+                    "s3:AbortMultipartUpload",
+                    "s3:ListMultipartUploadParts",
+                    "s3:PutObjectAcl"
+                ],
+                "Resource": "arn:aws:s3:::*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "lambda:GetFunction",
+                    "lambda:GetFunctionConfiguration"
+                ],
+                "Resource": "arn:aws:lambda:::function:*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "lambda:ListFunctions"
+                ],
+                "Resource": "arn:aws:lambda:::*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "iam:AttachRolePolicy",
+                    "iam:CreatePolicy",
+                    "iam:CreateRole",
+                    "iam:ListRoles",
+                    "iam:ListRolePolicies",
+                    "iam:PutRolePolicy"
+                ],
+                "Resource": [
+                    "*"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": "iam:PassRole",
+                "Resource": "arn:aws:iam::*:role/snowball*",
+                "Condition": {
+                    "StringEquals": {
+                        "iam:PassedToService": "importexport.amazonaws.com"
+                    }
+                }
+            },
+            {
+               "Effect": "Allow",
+               "Action": [
+                    "ec2:DescribeImages",
+                    "ec2:ModifyImageAttribute",
+               ],
+               "Resource": [
+                    "*"
+               ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "sns:CreateTopic",
+                    "sns:ListTopics",
+                    "sns:GetTopicAttributes",
+                    "sns:SetTopicAttributes",
+                    "sns:ListSubscriptionsByTopic",
+                    "sns:Subscribe"
+                ],
+                "Resource": [
+                    "*"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "greengrass:getServiceRoleForAccount"
+                ],
+                "Resource": [
+                "*"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "snowball:*"
+                ],
+                "Resource": [
+                    "*"
+                ]
+            }
+        ]
+    }
+    
+