AWS amazonq documentation change
Summary
Updated IAM policy examples to use static 'us-east-1' region and specific account ID placeholder {111122223333} in ARNs, standardized JSON formatting
Security assessment
Changes involve standardizing example policy syntax and using concrete region/account values, but no evidence of addressing a specific security vulnerability. Improves policy clarity but doesn't introduce new security controls.
Diff
diff --git a/amazonq/latest/qbusiness-ug/iam-roles-ds.md b/amazonq/latest/qbusiness-ug/iam-roles-ds.md index 10035bd90..9c5a3e1b3 100644 --- a//amazonq/latest/qbusiness-ug/iam-roles-ds.md +++ b//amazonq/latest/qbusiness-ug/iam-roles-ds.md @@ -50 +50,2 @@ JSON - "Statement": [{ + "Statement": [ + { @@ -58,2 +59,3 @@ JSON - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}"] + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}" + ] @@ -72,3 +74,3 @@ JSON - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}/data-source/*" + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}/data-source/*" @@ -105 +107 @@ JSON - "aws:SourceArn": "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}" + "aws:SourceArn": "arn:aws:qbusiness:us-east-1:{{source_account}}:application/{{application_id}}" @@ -138 +140,2 @@ JSON - "Statement": [{ + "Statement": [ + { @@ -146,2 +149,2 @@ JSON - "arn:aws:ec2:{{region}}:{{account_id}}:subnet/[[subnet_ids]]", - "arn:aws:ec2:{{region}}:{{account_id}}:security-group/[[security_group]]" + "arn:aws:ec2:us-east-1:{111122223333}:subnet/[[subnet_ids]]", + "arn:aws:ec2:us-east-1:{111122223333}:security-group/[[security_group]]" @@ -157 +160 @@ JSON - "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*", + "Resource": "arn:aws:ec2:{{region}}:{111122223333}:network-interface/*", @@ -160 +163 @@ JSON - "aws:RequestTag/AMAZON_Q": "qbusiness_{{account_id}}_{{application_id}}_*" + "aws:RequestTag/AMAZON_Q": "qbusiness_{111122223333}_{{application_id}}_*" @@ -175 +178 @@ JSON - "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*", + "Resource": "arn:aws:ec2:{{region}}:{111122223333}:network-interface/*", @@ -188 +191 @@ JSON - "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*", + "Resource": "arn:aws:ec2:{{region}}:{111122223333}:network-interface/*", @@ -191 +194 @@ JSON - "aws:ResourceTag/AMAZON_Q": "qbusiness_{{account_id}}_{{application_id}}_*" + "aws:ResourceTag/AMAZON_Q": "qbusiness_{111122223333}_{{application_id}}_*" @@ -301 +304 @@ JSON - "aws:ResourceAccount": "{{account_id}}" + "aws:ResourceAccount": "{111122223333}" @@ -316 +319 @@ JSON - "aws:ResourceAccount": "{{account_id}}" + "aws:ResourceAccount": "{111122223333}" @@ -328,2 +331,3 @@ JSON - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}"] + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}" + ] @@ -342,3 +346,3 @@ JSON - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}/data-source/*" + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}/data-source/*" @@ -395 +399 @@ JSON - "aws:ResourceAccount": "{{account_id}}" + "aws:ResourceAccount": "{111122223333}" @@ -410 +414 @@ JSON - "aws:ResourceAccount": "{{account_id}}" + "aws:ResourceAccount": "{111122223333}" @@ -422,2 +426,3 @@ JSON - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}"] + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}" + ] @@ -436,3 +441,3 @@ JSON - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}", - "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}/data-source/*" + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}", + "arn:aws:qbusiness:us-east-1:{111122223333}:application/{{application_id}}/index/{{index_id}}/data-source/*" @@ -449,2 +454,2 @@ JSON - "arn:aws:ec2:{{region}}:{{account_id}}:subnet/[[subnet_ids]]", - "arn:aws:ec2:{{region}}:{{account_id}}:security-group/[[security_group]]" + "arn:aws:ec2:us-east-1:{111122223333}:subnet/[[subnet_ids]]", + "arn:aws:ec2:us-east-1:{111122223333}:security-group/[[security_group]]" @@ -460 +465 @@ JSON - "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*", + "Resource": "arn:aws:ec2:{{region}}:{111122223333}:network-interface/*", @@ -463 +468 @@ JSON - "aws:RequestTag/AMAZON_Q": "qbusiness_{{account_id}}_{{application_id}}_*" + "aws:RequestTag/AMAZON_Q": "qbusiness_{111122223333}_{{application_id}}_*" @@ -478 +483 @@ JSON - "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*", + "Resource": "arn:aws:ec2:{{region}}:{111122223333}:network-interface/*", @@ -491 +496 @@ JSON - "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*", + "Resource": "arn:aws:ec2:{{region}}:{111122223333}:network-interface/*", @@ -494 +499 @@ JSON - "aws:ResourceTag/AMAZON_Q": "qbusiness_{{account_id}}_{{application_id}}_*" + "aws:ResourceTag/AMAZON_Q": "qbusiness_{111122223333}_{{application_id}}_*" @@ -540 +545 @@ JSON - "aws:SourceArn": "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}" + "aws:SourceArn": "arn:aws:qbusiness:us-east-1:{{source_account}}:application/{{application_id}}"