AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2025-08-13 · Documentation low

File: AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md

Summary

Standardized policy examples with placeholder replacements and added policy statement SIDs

Security assessment

Improves documentation clarity by using consistent placeholders and structured policies, but doesn't address specific security flaws

Diff

diff --git a/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md b/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md
index a0a690ff1..dec1cb5f7 100644
--- a//AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md
+++ b//AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md
@@ -135,0 +136 @@ JSON
+              "Sid": "AllowCloudWatchLogsGetBucketAcl",
@@ -138,2 +139,2 @@ JSON
-              "Resource": "arn:aws:s3:::my-exported-logs",
-              "Principal": { "Service": "logs.Region.amazonaws.com" },
+              "Resource": "arn:aws:s3:::amzn-s3-demo-bucket",
+              "Principal": { "Service": "logs.us-east-1.amazonaws.com" },
@@ -143,3 +144,2 @@ JSON
-                        "AccountId1",
-                        "AccountId2",
-                        ...
+                        "123456789012",
+                        "111122223333"
@@ -150,3 +150,2 @@ JSON
-                            "arn:aws:logs:Region:AccountId1:log-group:*",
-                            "arn:aws:logs:Region:AccountId2:log-group:*",
-                            ...
+                            "arn:aws:logs:us-east-1:123456789012:log-group:*",
+                            "arn:aws:logs:us-east-1:111122223333:log-group:*"
@@ -157,0 +157 @@ JSON
+              "Sid": "AllowCloudWatchLogsPutObject",
@@ -160,2 +160,2 @@ JSON
-              "Resource": "arn:aws:s3:::my-exported-logs/*",
-              "Principal": { "Service": "logs.Region.amazonaws.com" },
+              "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*",
+              "Principal": { "Service": "logs.us-east-1.amazonaws.com" },
@@ -166,3 +166,2 @@ JSON
-                        "AccountId1",
-                        "AccountId2",
-                        ...
+                        "123456789012",
+                        "111122223333"
@@ -173,3 +172,2 @@ JSON
-                            "arn:aws:logs:Region:AccountId1:log-group:*",
-                            "arn:aws:logs:Region:AccountId2:log-group:*",
-                            ...
+                            "arn:aws:logs:us-east-1:123456789012:log-group:*",
+                            "arn:aws:logs:us-east-1:111122223333:log-group:*"
@@ -416 +415 @@ JSON
-          "Resource": "arn:aws:s3:::my-exported-logs/*"
+          "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"
@@ -424 +423 @@ JSON
-          "Resource": "ARN_OF_KMS_KEY"
+          "Resource": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
@@ -507,2 +506,2 @@ JSON
-              "Resource": "arn:aws:s3:::my-exported-logs",
-              "Principal": { "Service": "logs.Region.amazonaws.com" },
+              "Resource": "arn:aws:s3:::<replaceable>&example-s3-bucket;</replaceable>",
+              "Principal": { "Service": "logs.<replaceable>&region_api_default;</replaceable>.amazonaws.com" },
@@ -512,3 +511,2 @@ JSON
-                        "AccountId1",
-                        "AccountId2",
-                        ...
+                        "<replaceable>&account_id_example;</replaceable>",
+                        "<replaceable>&ExampleAWSAccountNo1;</replaceable>"
@@ -519,3 +517,2 @@ JSON
-                            "arn:aws:logs:Region:AccountId1:log-group:*",
-                            "arn:aws:logs:Region:AccountId2:log-group:*",
-                            ...
+                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&account_id_example;</replaceable>:log-group:*",
+                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&ExampleAWSAccountNo1;</replaceable>:log-group:*"
@@ -529,2 +526,2 @@ JSON
-              "Resource": "arn:aws:s3:::my-exported-logs/*",
-              "Principal": { "Service": "logs.Region.amazonaws.com" },
+              "Resource": "arn:aws:s3:::<replaceable>&example-s3-bucket;</replaceable>/*",
+              "Principal": { "Service": "logs.<replaceable>&region_api_default;</replaceable>.amazonaws.com" },
@@ -535,3 +532,2 @@ JSON
-                        "AccountId1",
-                        "AccountId2",
-                        ...
+                        "<replaceable>&account_id_example;</replaceable>",
+                        "<replaceable>&ExampleAWSAccountNo1;</replaceable>"
@@ -542,3 +538,2 @@ JSON
-                            "arn:aws:logs:Region:AccountId1:log-group:*",
-                            "arn:aws:logs:Region:AccountId2:log-group:*",
-                            ...
+                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&account_id_example;</replaceable>:log-group:*",
+                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&ExampleAWSAccountNo1;</replaceable>:log-group:*"
@@ -552 +547 @@ JSON
-                "AWS": "arn:aws:iam::create_export_task_caller_account:role/role_name"
+                "AWS": "arn:aws:iam::<replaceable>&ExampleAWSAccountNo1;</replaceable>:role/<replaceable>role_name</replaceable>"
@@ -555 +550 @@ JSON
-              "Resource": "arn:aws:s3:::my-exported-logs/*",
+              "Resource": "arn:aws:s3:::<replaceable>&example-s3-bucket;</replaceable>/*",