AWS aurora-dsql high security documentation change
Summary
Updated IAM policy examples with specific service names (dsql/backup) and corrected ARN patterns for confused deputy prevention
Security assessment
Directly addresses security best practices for preventing confused deputy attacks by providing accurate service-specific ARN patterns and policy examples. Fixes placeholder values that could lead to misconfigurations
Diff
diff --git a/aurora-dsql/latest/userguide/cross-service-confused-deputy-prevention.md b/aurora-dsql/latest/userguide/cross-service-confused-deputy-prevention.md index 4e1226e21..8149d1e08 100644 --- a//aurora-dsql/latest/userguide/cross-service-confused-deputy-prevention.md +++ b//aurora-dsql/latest/userguide/cross-service-confused-deputy-prevention.md @@ -11 +11 @@ We recommend using the [`aws:SourceArn`](https://docs.aws.amazon.com/IAM/latest/ -The most effective way to protect against the confused deputy problem is to use the `aws:SourceArn` global condition context key with the full ARN of the resource. If you don't know the full ARN of the resource or if you are specifying multiple resources, use the `aws:SourceArn` global context condition key with wildcard characters (`*`) for the unknown portions of the ARN. For example, `arn:aws:`servicename`:*:`123456789012`:*`. +The most effective way to protect against the confused deputy problem is to use the `aws:SourceArn` global condition context key with the full ARN of the resource. If you don't know the full ARN of the resource or if you are specifying multiple resources, use the `aws:SourceArn` global context condition key with wildcard characters (`*`) for the unknown portions of the ARN. For example, `arn:aws:`dsql`:*:`123456789012`:*`. @@ -32 +32 @@ JSON - "Service": "servicename.amazonaws.com" + "Service": "backup.amazonaws.com" @@ -34 +34 @@ JSON - "Action": "servicename:ActionName", + "Action": "dsql:GetCluster", @@ -36 +36 @@ JSON - "arn:aws:servicename:::ResourceName/*" + "arn:aws:dsql:*:123456789012:cluster/*" @@ -40 +40 @@ JSON - "aws:SourceArn": "arn:aws:servicename:*:123456789012:*" + "aws:SourceArn": "arn:aws:backup:*:123456789012:*"