AWS AmazonS3 documentation change
Summary
Added detailed console instructions for viewing/modifying/deleting access point scopes, clarified scope modification behavior, and expanded supported methods to include AWS Management Console
Security assessment
The changes document how to manage access control scopes through the console, which is a security feature. However, there's no evidence this addresses a specific vulnerability - rather it expands documentation for existing security controls. The implicit wildcard clarification helps prevent misconfigurations but doesn't indicate a resolved vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md b/AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md index 5066d75b0..759038b51 100644 --- a//AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md +++ b//AmazonS3/latest/userguide/access-points-directory-buckets-manage-scope.md @@ -25,0 +26,19 @@ You can use the AWS Management Console, AWS Command Line Interface, REST API, or +###### To view the scope of your access point for directory buckets + + 1. Sign in to the AWS Management Console and open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). + + 2. In the navigation bar on the top of the page, choose the name of the currently displayed AWS Region. Next, choose the Region that you want to list access points for. + + 3. In the navigation pane on the left side of the console, choose **Access points for directory buckets**. + + 4. (Optional) Search for access points by name. Only access points in your selected AWS Region will appear here. + + 5. Choose the name of the access point you want to manage. + + 6. Choose the **Permissions** tab. + + 7. In the **Access point scope** , you can see the prefixes and permissions applied to the access point. + + + + @@ -85 +104 @@ You can use the AWS SDKs to view the scope of your access point. For more inform -You can use the AWS Command Line Interface, REST API, or AWS SDKs to modify the scope of your access points for directory buckets. Access point scope is used to restrict access to specific prefixes, API operations, or a combination of both. +You can use the AWS Management Console, AWS Command Line Interface, REST API, or AWS SDKs to modify the scope of your access points for directory buckets. Access point scope is used to restrict access to specific prefixes, API operations, or a combination of both. @@ -110 +129,19 @@ You can include one or more of the following API operations as permissions: - * You can specify any amount of prefixes, but the total length of characters of all prefixes must be less than 256 bytes in size. +You can specify any amount of prefixes, but the total length of characters of all prefixes must be less than 256 bytes in size. + +###### To modify access point scope + + 1. Sign in to the AWS Management Console and open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). + + 2. In the navigation bar on the top of the page, choose the name of the currently displayed AWS Region. Next, choose the Region that you want to list access points for. + + 3. In the navigation pane on the left side of the console, choose **Access points for directory buckets**. + + 4. (Optional) Search for access points by name. Only access points in your selected AWS Region will appear here. + + 5. Choose the name of the access point you want to manage. + + 6. Choose the **Permissions** tab. + + 7. In the **Access point scope** section, choose **Edit**. + + 8. To add or remove prefixes: @@ -112 +149,11 @@ You can include one or more of the following API operations as permissions: - * When you modify the scope of an access point, you replace the existing scope. + 1. To add a prefix, choose **Add prefix**. In the **Prefix** field, enter a prefix of the directory bucket. Repeat to add more prefixes. + + 2. To remove a prefix, choose **Remove**. + + 9. To add or remove permissions: + + 1. To add a permission, in the **Choose data operations** field, choose the permission. + + 2. To remove a permission, choose the **X** next to the permission. + + 10. Choose **Save changes**. @@ -125 +172,3 @@ You can use wildcards in prefixes by using the asterisk (*) character. If you wa -Also, all prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. +All prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. + +When you modify the scope of an access point with the AWS CLI, you replace the existing scope. @@ -140 +189,3 @@ You can use wildcards in prefixes by using the asterisk (*) character. If you wa -Also, all prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. +All prefixes have an implicit '*' ending, meaning all paths withing the prefix will be included. + +When you modify the scope of an access point with the API, you replace the existing scope. @@ -164 +215 @@ You can use the AWS CLI, AWS SDKs, or REST API to modify the scope of your acces -You can use the AWS Command Line Interface, REST API, or AWS SDKs to delete the scope of your access points for directory buckets. +You can use the AWS Management Console, AWS Command Line Interface, REST API, or AWS SDKs to delete the scope of your access points for directory buckets. @@ -169,0 +221,23 @@ When you delete the scope of an access point, all prefixes and permissions are d +###### To delete access point scope + + 1. Sign in to the AWS Management Console and open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). + + 2. In the navigation bar on the top of the page, choose the name of the currently displayed AWS Region. Next, choose the Region that you want to list access points for. + + 3. In the navigation pane on the left side of the console, choose **Access points for directory buckets**. + + 4. (Optional) Search for access points by name. Only access points in your selected AWS Region will appear here. + + 5. Choose the name of the access point you want to manage. + + 6. Choose the **Permissions** tab. + + 7. In **Access point scope** , choose **Delete**. + + 8. In the **to confirm this deletion, type "confirm".** field, enter `confirm`. + + 9. Choose **Delete**. + + + +