AWS managed-flink medium security documentation change
Summary
Added JSON section markers and updated IAM policy examples with concrete account IDs and resource ARNs
Security assessment
Changes include updates to IAM policy resource ARNs with specific account IDs (e.g., 123456789012), which helps prevent misconfiguration of cross-account permissions. This addresses potential security risks from overly broad resource definitions in IAM policies.
Diff
diff --git a/managed-flink/latest/java/earlier.md b/managed-flink/latest/java/earlier.md index e2a55a6c2..9519f324a 100644 --- a//managed-flink/latest/java/earlier.md +++ b//managed-flink/latest/java/earlier.md @@ -626,0 +627,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -756,0 +764,6 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss +JSON + + +**** + + @@ -1606,0 +1621,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -1738,0 +1760,6 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss +JSON + + +**** + + @@ -2588,0 +2617,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -2723,0 +2759,6 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss +JSON + + +**** + + @@ -3550,0 +3593,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -3681,0 +3731,6 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss +JSON + + +**** + + @@ -4306,0 +4363,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -4716,0 +4780,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -5956,0 +6027,6 @@ These permissions grant the application the ability to access the EFO consumer. +JSON + + +**** + + @@ -6439,0 +6517,6 @@ Edit the IAM policy to add permissions to access the Kinesis data stream and Fir +JSON + + +**** + + @@ -6561,0 +6646,6 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss +JSON + + +**** + + @@ -6965,0 +7057,6 @@ Add the highlighted section below to the policy. Replace the sample account ID ( +JSON + + +**** + + @@ -6973 +7070 @@ Add the highlighted section below to the policy. Replace the sample account ID ( - "Resource": "arn:aws:iam::SOURCE01234567:role/KA-Source-Stream-Role" + "Resource": "arn:aws:iam::123456789012:role/KA-Source-Stream-Role" @@ -6993 +7090 @@ Add the highlighted section below to the policy. Replace the sample account ID ( - "arn:aws:logs:us-west-2:SINK012345678:log-group:*" + "arn:aws:logs:us-west-2:123456789012:log-group:*" @@ -7003 +7100 @@ Add the highlighted section below to the policy. Replace the sample account ID ( - "arn:aws:logs:us-west-2:SINK012345678:log-group:/aws/kinesis-analytics/MyApplication:log-stream:*" + "arn:aws:logs:us-west-2:123456789012:log-group:/aws/kinesis-analytics/MyApplication:log-stream:*" @@ -7013 +7110 @@ Add the highlighted section below to the policy. Replace the sample account ID ( - "arn:aws:logs:us-west-2:SINK012345678:log-group:/aws/kinesis-analytics/MyApplication:log-stream:kinesis-analytics-log-stream" + "arn:aws:logs:us-west-2:123456789012:log-group:/aws/kinesis-analytics/MyApplication:log-stream:kinesis-analytics-log-stream" @@ -7030,0 +7129,6 @@ Add the highlighted section below to the policy. Replace the sample account ID ( +JSON + + +**** + + @@ -7043,2 +7147 @@ Add the highlighted section below to the policy. Replace the sample account ID ( - "Resource": - "arn:aws:kinesis:us-west-2:SOURCE123456784:stream/SourceAccountExampleInputStream" + "Resource": "arn:aws:kinesis:us-west-2:111122223333:stream/SourceAccountExampleInputStream" @@ -7075,0 +7179,6 @@ Add the highlighted section below to the policy. Replace the sample account ID ( +JSON + + +**** + + @@ -7082 +7191 @@ Add the highlighted section below to the policy. Replace the sample account ID ( - "AWS": "arn:aws:iam::SINK012345678:role/service-role/kinesis-analytics-MyApplication-us-west-2" + "AWS": "arn:aws:iam::111122223333:role/service-role/kinesis-analytics-MyApplication-us-west-2" @@ -7840,0 +7950,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -8291,0 +8408,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -8756,0 +8880,6 @@ Edit the IAM policy to add permissions to access the Kinesis data streams. +JSON + + +**** + + @@ -9187,0 +9318,6 @@ Edit the IAM policy to add permissions to access the Amazon S3 bucket. +JSON + + +**** + + @@ -9883,0 +10021,6 @@ Edit the IAM policy to add permissions to access the Amazon S3 bucket. +JSON + + +**** + + @@ -10562,0 +10707,6 @@ Edit the IAM policy to add permissions to access the Amazon S3 bucket. +JSON + + +**** + + @@ -10646,0 +10798,6 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss +JSON + + +**** + + @@ -10669 +10826 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss - "arn:aws:logs:us-west-2:012345678901:log-group:*" + "arn:aws:logs:us-west-2:123456789012:*" @@ -10679 +10836 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss - "arn:aws:logs:us-west-2:012345678901:log-group:/aws/kinesis-analytics/MyApplication:log-stream:*" + "arn:aws:logs:us-west-2:123456789012:log-group:/aws/kinesis-analytics/MyApplication:log-stream:*" @@ -10689 +10846 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss - "arn:aws:logs:us-west-2:012345678901:log-group:/aws/kinesis-analytics/MyApplication:log-stream:kinesis-analytics-log-stream" + "arn:aws:logs:us-west-2:123456789012:log-group:/aws/kinesis-analytics/MyApplication:log-stream:kinesis-analytics-log-stream" @@ -10696 +10853 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss - "Resource": "arn:aws:kinesis:us-west-2:012345678901:stream/ExampleInputStream" + "Resource": "arn:aws:kinesis:us-west-2:123456789012:stream/ExampleInputStream" @@ -10702 +10859 @@ Use the following code to create the `AKReadSourceStreamWriteSinkStream` permiss - "Resource": "arn:aws:kinesis:us-west-2:012345678901:stream/ExampleOutputStream" + "Resource": "arn:aws:kinesis:us-west-2:123456789012:stream/ExampleOutputStream"