AWS cli medium security documentation change
Summary
Updated IAM instance profile requirements to enforce role naming conventions and added link to security documentation
Security assessment
Enforces IAM role name patterns (AWSPCS prefix or /aws-pcs/ path) to prevent misconfigured permissions, with explicit reference to security documentation. This addresses potential authorization risks.
Diff
diff --git a/cli/latest/reference/pcs/update-compute-node-group.md b/cli/latest/reference/pcs/update-compute-node-group.md index 8bf1242cf..28208da88 100644 --- a//cli/latest/reference/pcs/update-compute-node-group.md +++ b//cli/latest/reference/pcs/update-compute-node-group.md @@ -15 +15 @@ - * [AWS CLI 2.28.8 Command Reference](../../index.html) » + * [AWS CLI 2.28.11 Command Reference](../../index.html) » @@ -217,8 +217 @@ JSON Syntax: -> The Amazon Resource Name (ARN) of the IAM instance profile used to pass an IAM role when launching EC2 instances. The role contained in your instance profile must have the `pcs:RegisterComputeNodeGroupInstance` permission. The resource identifier of the ARN must start with `AWSPCS` or it must have `/aws-pcs/` in its path. -> ->> **Examples** -> -> * `arn:aws:iam::111122223333:instance-profile/AWSPCS-example-role-1` -> * `arn:aws:iam::111122223333:instance-profile/aws-pcs/example-role-2` -> - +> The Amazon Resource Name (ARN) of the IAM instance profile used to pass an IAM role when launching EC2 instances. The role contained in your instance profile must have the `pcs:RegisterComputeNodeGroupInstance` permission and the role name must start with `AWSPCS` or must have the path `/aws-pcs/` . For more information, see [IAM instance profiles for PCS](https://docs.aws.amazon.com/pcs/latest/userguide/security-instance-profiles.html) in the _PCS User Guide_ . @@ -449,8 +442 @@ computeNodeGroup -> (structure) ->> The Amazon Resource Name (ARN) of the IAM instance profile used to pass an IAM role when launching EC2 instances. The role contained in your instance profile must have the `pcs:RegisterComputeNodeGroupInstance` permission. The resource identifier of the ARN must start with `AWSPCS` or it must have `/aws-pcs/` in its path. ->> ->>> **Examples** ->> ->> * `arn:aws:iam::111122223333:instance-profile/AWSPCS-example-role-1` ->> * `arn:aws:iam::111122223333:instance-profile/aws-pcs/example-role-2` ->> - +>> The Amazon Resource Name (ARN) of the IAM instance profile used to pass an IAM role when launching EC2 instances. The role contained in your instance profile must have the `pcs:RegisterComputeNodeGroupInstance` permission and the role name must start with `AWSPCS` or must have the path `/aws-pcs/` . For more information, see [IAM instance profiles for PCS](https://docs.aws.amazon.com/pcs/latest/userguide/security-instance-profiles.html) in the _PCS User Guide_ . @@ -548 +534 @@ computeNodeGroup -> (structure) - * [AWS CLI 2.28.8 Command Reference](../../index.html) » + * [AWS CLI 2.28.11 Command Reference](../../index.html) »