AWS chatbot medium security documentation change
Summary
Updated terminology from 'chat channels' to 'chat applications' and modified policy example condition key from StringLike to ArnLike
Security assessment
The change from StringLike to ArnLike in the SCP example improves security by enforcing stricter ARN matching in policies, reducing potential misconfiguration risks. This addresses a security control precision issue.
Diff
diff --git a/chatbot/latest/adminguide/scp.md b/chatbot/latest/adminguide/scp.md index ef64ae627..e56eb5553 100644 --- a//chatbot/latest/adminguide/scp.md +++ b//chatbot/latest/adminguide/scp.md @@ -9 +9 @@ AWS Chatbot is now Amazon Q Developer. [Learn more](./service-rename.html) -# Service control policies (SCPs) for Amazon Q Developer in chat channels +# Service control policies (SCPs) for Amazon Q Developer in chat applications @@ -13 +13 @@ Service control policies (SCPs) are a type of organization policy that you can u -SCPs for Amazon Q Developer in chat channels function similarly to channel guardrail policies, but are implemented on the organization level. You can use SCPs to secure your organizations by restricting what APIs can be used to configure Amazon Q Developer in chat channels and which services and operations can be run using Amazon Q Developer. This doesn’t impact resources that are already created or the ability to respond to commands in chat channels. +SCPs for Amazon Q Developer in chat applications function similarly to channel guardrail policies, but are implemented on the organization level. You can use SCPs to secure your organizations by restricting what APIs can be used to configure Amazon Q Developer in chat applications and which services and operations can be run using Amazon Q Developer. This doesn’t impact resources that are already created or the ability to respond to commands in chat channels. @@ -15 +15 @@ SCPs for Amazon Q Developer in chat channels function similarly to channel guard -The global condition key, `aws:ChatbotSourceArn`, is attached to all sessions created through Amazon Q Developer in chat channels. You can use this condition key to restrict which Amazon Q Developer in chat channels API operations can be run using Amazon Q Developer in chat channels as opposed to other platforms such as the CLI or console. +The global condition key, `aws:ChatbotSourceArn`, is attached to all sessions created through Amazon Q Developer in chat applications. You can use this condition key to restrict which Amazon Q Developer in chat applications API operations can be run using Amazon Q Developer in chat applications as opposed to other platforms such as the CLI or console. @@ -19 +19 @@ The global condition key, `aws:ChatbotSourceArn`, is attached to all sessions cr -SCPs for Amazon Q Developer in chat channels are limited to Amazon Q Developer access in chat applications and don't apply to Amazon Q Business access from chat applications. +SCPs for Amazon Q Developer in chat applications are limited to Amazon Q Developer access in chat applications and don't apply to Amazon Q Business access from chat applications. @@ -32 +32 @@ SCPs for Amazon Q Developer in chat channels are limited to Amazon Q Developer a -The following SCP denies all IAM operations invoked through all Amazon Q Developer in chat channels configurations. +The following SCP denies all IAM operations invoked through all Amazon Q Developer in chat applications configurations. @@ -49,0 +50,6 @@ The following SCP denies S3 put requests on the specified bucket for all request +JSON + + +**** + + @@ -60 +66 @@ The following SCP denies S3 put requests on the specified bucket for all request - "StringLike": { + "ArnLike": {