AWS appsync medium security documentation change

Service: appsync · 2025-08-10 · Security-related medium

File: appsync/latest/devguide/tutorial-rds-resolvers.md

Summary

Revised IAM permissions for RDS Data API to use transaction management actions (BatchExecuteStatement, BeginTransaction, etc.) instead of CRUD operations

Security assessment

Replaces overly broad data manipulation permissions with granular transaction controls, enforcing least privilege and reducing potential attack surface for RDS interactions.

Diff

diff --git a/appsync/latest/devguide/tutorial-rds-resolvers.md b/appsync/latest/devguide/tutorial-rds-resolvers.md
index 52650a1bd..c4e414d7d 100644
--- a//appsync/latest/devguide/tutorial-rds-resolvers.md
+++ b//appsync/latest/devguide/tutorial-rds-resolvers.md
@@ -227,2 +227,3 @@ JSON
-                    "rds-data:DeleteItems",
-                    "rds-data:ExecuteSql",
+                    "rds-data:BatchExecuteStatement",
+                    "rds-data:BeginTransaction",
+                    "rds-data:CommitTransaction",
@@ -230,3 +231 @@ JSON
-                    "rds-data:GetItems",
-                    "rds-data:InsertItems",
-                    "rds-data:UpdateItems"
+                    "rds-data:RollbackTransaction"
@@ -235,2 +234,2 @@ JSON
-                    "arn:aws:rds:us-east-1:123456789012:cluster:mydbcluster",
-                    "arn:aws:rds:us-east-1:123456789012:cluster:mydbcluster:*"
+                    "arn:aws:rds:us-east-1:111122223333:cluster:mydbcluster",
+                    "arn:aws:rds:us-east-1:111122223333:cluster:mydbcluster:*"
@@ -245,2 +244,2 @@ JSON
-                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret",
-                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret:*"
+                "arn:aws:secretsmanager:us-east-1:111122223333:secret:mysecret",
+                "arn:aws:secretsmanager:us-east-1:111122223333:secret:mysecret:*"
@@ -352,2 +351,3 @@ JSON
-                        "rds-data:DeleteItems",
-                        "rds-data:ExecuteSql",
+                        "rds-data:BatchExecuteStatement",
+                        "rds-data:BeginTransaction",
+                        "rds-data:CommitTransaction",
@@ -355,3 +355 @@ JSON
-                        "rds-data:GetItems",
-                        "rds-data:InsertItems",
-                        "rds-data:UpdateItems"
+                        "rds-data:RollbackTransaction"