AWS AWSEC2 medium security documentation change
Summary
Replaced account_id placeholder with 111122223333 in confused deputy prevention examples
Security assessment
Addresses confused deputy risk by demonstrating proper source account/ARN restrictions in trust policies. This is a security best practice to prevent cross-account privilege escalation.
Diff
diff --git a/AWSEC2/latest/UserGuide/spot-fleet-prerequisites.md b/AWSEC2/latest/UserGuide/spot-fleet-prerequisites.md index 92149bfbe..24d2a8248 100644 --- a//AWSEC2/latest/UserGuide/spot-fleet-prerequisites.md +++ b//AWSEC2/latest/UserGuide/spot-fleet-prerequisites.md @@ -304 +304 @@ The [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/c - "aws:SourceArn": "arn:aws:ec2:us-east-1:account_id:spot-fleet-request/sfr-*" + "aws:SourceArn": "arn:aws:ec2:us-east-1:111122223333:spot-fleet-request/sfr-*" @@ -307 +307 @@ The [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/c - "aws:SourceAccount": "account_id" + "aws:SourceAccount": "111122223333" @@ -327 +327 @@ The final trust policy will be as follows: - "aws:SourceArn": "arn:aws:ec2:us-east-1:account_id:spot-fleet-request/sfr-*" + "aws:SourceArn": "arn:aws:ec2:us-east-1:111122223333:spot-fleet-request/sfr-*" @@ -330 +330 @@ The final trust policy will be as follows: - "aws:SourceAccount": "account_id" + "aws:SourceAccount": "111122223333"