AWS AmazonCloudWatch documentation change
Summary
Updated S3 bucket policies with specific resource ARNs, account IDs, and added structured policy statements with SIDs
Security assessment
Changes provide more precise example policies with proper principal restrictions and resource ARNs, enhancing security documentation without fixing vulnerabilities
Diff
diff --git a/AmazonCloudWatch/latest/logs/S3ExportTasks.md b/AmazonCloudWatch/latest/logs/S3ExportTasks.md index 6d72f7599..f96b5246d 100644 --- a//AmazonCloudWatch/latest/logs/S3ExportTasks.md +++ b//AmazonCloudWatch/latest/logs/S3ExportTasks.md @@ -126,0 +128 @@ JSON + "Sid": "AllowGetBucketAcl", @@ -129,2 +131,2 @@ JSON - "Resource": "arn:aws:s3:::my-exported-logs", - "Principal": { "Service": "logs.Region.amazonaws.com" }, + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket", + "Principal": { "Service": "logs.us-east-1.amazonaws.com" }, @@ -134,3 +136,2 @@ JSON - "AccountId1", - "AccountId2", - ... + "123456789012", + "111122223333" @@ -141,3 +142,2 @@ JSON - "arn:aws:logs:Region:AccountId1:log-group:*", - "arn:aws:logs:Region:AccountId2:log-group:*", - ... + "arn:aws:logs:us-east-1:123456789012:log-group:*", + "arn:aws:logs:us-east-1:111122223333:log-group:*" @@ -148,0 +149 @@ JSON + "Sid": "AllowPutObject", @@ -151,2 +152,2 @@ JSON - "Resource": "arn:aws:s3:::my-exported-logs/*", - "Principal": { "Service": "logs.Region.amazonaws.com" }, + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*", + "Principal": { "Service": "logs.us-east-1.amazonaws.com" }, @@ -157,3 +158,2 @@ JSON - "AccountId1", - "AccountId2", - ... + "123456789012", + "111122223333" @@ -164,3 +164,2 @@ JSON - "arn:aws:logs:Region:AccountId1:log-group:*", - "arn:aws:logs:Region:AccountId2:log-group:*", - ... + "arn:aws:logs:us-east-1:123456789012:log-group:*", + "arn:aws:logs:us-east-1:111122223333:log-group:*" @@ -392 +391 @@ JSON - "Resource": "arn:aws:s3:::my-exported-logs/*" + "Resource": "arn:aws:s3:::>amzn-s3-demo-bucket/*" @@ -400 +399 @@ JSON - "Resource": "ARN_OF_KMS_KEY" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" @@ -468,2 +467,2 @@ JSON - "Resource": "arn:aws:s3:::my-exported-logs", - "Principal": { "Service": "logs.Region.amazonaws.com" }, + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket", + "Principal": { "Service": "logs.us-east-1.amazonaws.com" }, @@ -473,3 +472,2 @@ JSON - "AccountId1", - "AccountId2", - ... + "123456789012", + "111122223333" @@ -480,3 +478,2 @@ JSON - "arn:aws:logs:Region:AccountId1:log-group:*", - "arn:aws:logs:Region:AccountId2:log-group:*", - ... + "arn:aws:logs:us-east-1:123456789012:log-group:*", + "arn:aws:logs:us-east-1:111122223333:log-group:*" @@ -496,3 +493,2 @@ JSON - "AccountId1", - "AccountId2", - ... + "123456789012", + "111122223333" @@ -503,3 +499,2 @@ JSON - "arn:aws:logs:Region:AccountId1:log-group:*", - "arn:aws:logs:Region:AccountId2:log-group:*", - ... + "arn:aws:logs:us-east-1:123456789012:log-group:*", + "arn:aws:logs:us-east-1:111122223333:log-group:*" @@ -513 +508 @@ JSON - "AWS": "arn:aws:iam::create_export_task_caller_account:role/role_name" + "AWS": "arn:aws:iam::111122223333:role/role_name" @@ -516 +511 @@ JSON - "Resource": "arn:aws:s3:::my-exported-logs/*", + "Resource": "arn:aws:s3:::>amzn-s3-demo-bucket/*", @@ -560 +555 @@ JSON - "Sid": "Allow CWL Service Principal usage", + "Sid": "AllowCWLServicePrincipalUsage", @@ -563 +558 @@ JSON - "Service": "logs.Region.amazonaws.com" + "Service": "logs.us-east-1.amazonaws.com" @@ -575 +570 @@ JSON - "AWS": "account-ARN" + "AWS": "arn:aws:iam::123456789012:root" @@ -597 +592 @@ JSON - "Resource": "ARN_OF_KMS_KEY" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"