AWS firehose documentation change
Summary
Updated example ARNs with specific regions, account IDs, and corrected formatting. Modified resource tag condition from 'MyKey' to 'Environment'.
Security assessment
The change demonstrates tag-based access control (security feature) but does not address a specific vulnerability. ARN updates are example standardization.
Diff
diff --git a/firehose/latest/dev/controlling-access.md b/firehose/latest/dev/controlling-access.md index 5be6f127f..afcea3727 100644 --- a//firehose/latest/dev/controlling-access.md +++ b//firehose/latest/dev/controlling-access.md @@ -85 +85 @@ JSON - "arn:aws:firehose:region:account-id:deliverystream/delivery-stream-name" + "arn:aws::firehose:us-east-1:111122223333:deliverystream/delivery-stream-name" @@ -116 +116 @@ JSON - "Resource": "cluster-arn" + "Resource": "arn:aws::kafka:us-east-1:123456789012:cluster/*" @@ -201 +201 @@ JSON - "Resource": "CLUSTER-ARN" + "Resource": "arn:aws::Firehose:us-east-1:123456789012:CLUSTER-ARN" @@ -210 +210 @@ JSON - "Resource": "TOPIC-ARN" + "Resource": "arn:aws::Firehose:us-east-1:123456789012:TOPIC-ARN" @@ -280 +280 @@ JSON - "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name" + "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name" @@ -289 +289 @@ JSON - "arn:aws:kms:region:account-id:key/key-id" + "arn:aws::kms:us-east-1:123456789012:key/key-id" @@ -293 +293 @@ JSON - "kms:ViaService": "s3.region.amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -306 +306 @@ JSON - "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name" + "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name:log-stream:log-stream-name" @@ -316 +316 @@ JSON - "arn:aws:lambda:region:account-id:function:function-name:function-version" + "arn:aws:lambda:us-east-1:123456789012:function:function-name:function-version" @@ -387,5 +387,5 @@ JSON - "arn:aws:glue:<region>:<account-id>:catalog/s3tablescatalog/*", - "arn:aws:glue:<region>:<account-id>:catalog/s3tablescatalog", - "arn:aws:glue:<region>:<account-id>:catalog", - "arn:aws:glue:<region>:<account-id>:database/*", - "arn:aws:glue:<region>:<account-id>:table/*/*" + "arn:aws::glue:us-east-1123456789012:catalog/s3tablescatalog/*", + "arn:aws::glue:us-east-1:123456789012:catalog/s3tablescatalog", + "arn:aws::glueus-east-1:123456789012:catalog", + "arn:aws::glueus-east-1:123456789012:database/*", + "arn:aws::glueus-east-1:123456789012:table/*/*" @@ -419 +419 @@ JSON - "Resource": "arn:aws:kinesis:<region>:<account-id>:stream/<stream-name>" + "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/<stream-name>" @@ -437 +437 @@ JSON - "arn:aws:kms:<region>:<account-id>:key/<KMS-key-id>" + "arn:aws::kms:us-east-1:123456789012:key/KMS-key-id>" @@ -441 +441 @@ JSON - "kms:ViaService": "s3.<region>.amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -455 +455 @@ JSON - "arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:log-stream:<log-stream-name>" + "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name>:log-stream:log-stream-name>" @@ -466 +466 @@ JSON - "arn:aws:lambda:<region>:<account-id>:function:<function-name>:<function-version>" + "arn:aws::lambda:us-east-1:123456789012:function:function-name>:function-version>" @@ -511,3 +511,3 @@ JSON - "arn:aws:glue:<region>:<aws-account-id>:catalog", - "arn:aws:glue:<region>:<aws-account-id>:database/*", - "arn:aws:glue:<region>:<aws-account-id>:table/*/*" + "arn:aws::glue:<us-east-1>:123456789012>:catalog", + "arn:aws::glue:<us-east-1>:123456789012>:database/*", + "arn:aws::glue:<us-east-1>:123456789012>:table/*/*" @@ -528,2 +528,2 @@ JSON - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" + "arn:aws::s3:::amzn-s3-demo-bucket", + "arn:aws::s3:::amzn-s3-demo-bucket/*" @@ -540 +540 @@ JSON - "Resource": "arn:aws:kinesis:<region>:<aws-account-id>:stream/<stream-name>" + "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name>" @@ -549 +549 @@ JSON - "arn:aws:kms:<region>:<aws-account-id>:key/<key-id>" + "arn:aws::kms:<us-east-1>:<123456789012>:key/<key-id>" @@ -553 +553 @@ JSON - "kms:ViaService": "s3.region.amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -556 +556 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" @@ -566 +566 @@ JSON - "arn:aws:logs:<region>:<aws-account-id>:log-group:<log-group-name>:log-stream:<log-stream-name>" + "arn:aws::logs:<us-east-1:123456789012>:log-group:log-group-name>:log-stream:log-stream-name>" @@ -576 +576 @@ JSON - "arn:aws:lambda:<region>:<aws-account-id>:function:<function-name>:<function-version>" + "arn:aws::lambda:us-east-1:123456789012:function:function-name>:function-version>" @@ -654 +654 @@ JSON - "arn:aws:kms:region:account-id:key/key-id" + "arn:aws::kms:US West (Oregon):123456789012:key/key-id" @@ -658 +658 @@ JSON - "kms:ViaService": "s3.region.amazonaws.com" + "kms:ViaService": "s3.US West (Oregon).amazonaws.com" @@ -673 +673 @@ JSON - "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name" + "Resource": "arn:aws::kinesis:US West (Oregon):123456789012:stream/stream-name" @@ -681 +681 @@ JSON - "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name" + "arn:aws::logs:US West (Oregon):123456789012:log-group:log-group-name:log-stream:log-stream-name" @@ -691 +691 @@ JSON - "arn:aws:lambda:region:account-id:function:function-name:function-version" + "arn:aws::lambda:US West (Oregon):123456789012:function:function-name:function-version" @@ -773,2 +773,2 @@ JSON - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" + "arn:aws::s3:::amzn-s3-demo-bucket", + "arn:aws::s3:::amzn-s3-demo-bucket/*" @@ -784 +784 @@ JSON - "arn:aws:kms:region:account-id:key/key-id" + "arn:aws::kms:us-east-1:123456789012:key/key-id" @@ -788 +788 @@ JSON - "kms:ViaService": "s3.region.amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -791 +791 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" @@ -805,2 +805,2 @@ JSON - "arn:aws:es:region:account-id:domain/domain-name", - "arn:aws:es:region:account-id:domain/domain-name/*" + "arn:aws::es:us-east-1:123456789012:domain/domain-name", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/*" @@ -815,9 +815,9 @@ JSON - "arn:aws:es:region:account-id:domain/domain-name/_all/_settings", - "arn:aws:es:region:account-id:domain/domain-name/_cluster/stats", - "arn:aws:es:region:account-id:domain/domain-name/index-name*/_mapping/type-name", - "arn:aws:es:region:account-id:domain/domain-name/_nodes", - "arn:aws:es:region:account-id:domain/domain-name/_nodes/stats", - "arn:aws:es:region:account-id:domain/domain-name/_nodes/*/stats", - "arn:aws:es:region:account-id:domain/domain-name/_stats", - "arn:aws:es:region:account-id:domain/domain-name/index-name*/_stats", - "arn:aws:es:region:account-id:domain/domain-name/" + "arn:aws::es:us-east-1:123456789012:domain/domain-name/_all/_settings", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/_cluster/stats", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/index-name*/_mapping/type-name", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/_nodes", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/_nodes/stats", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/_nodes/*/stats", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/_stats", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/index-name*/_stats", + "arn:aws::es:us-east-1:123456789012:domain/domain-name/" @@ -834 +834 @@ JSON - "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name" + "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name" @@ -842 +842 @@ JSON - "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name" + "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name:log-stream:log-stream-name" @@ -852 +852 @@ JSON - "arn:aws:lambda:region:account-id:function:function-name:function-version" + "arn:aws::lambda:us-east-1:123456789012:function:function-name:function-version" @@ -923,2 +923,2 @@ JSON - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" + "arn:aws::s3:::amzn-s3-demo-bucket", + "arn:aws::s3:::amzn-s3-demo-bucket/*" @@ -934 +934 @@ JSON - "arn:aws:kms:region:account-id:key/key-id" + "arn:aws::kms:us-east-1:123456789012:key/key-id" @@ -938 +938 @@ JSON - "kms:ViaService": "s3.region.amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -941 +941 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" @@ -953 +953 @@ JSON - "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name" + "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name" @@ -961 +961 @@ JSON - "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name" + "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name:log-stream:log-stream-name" @@ -971 +971 @@ JSON - "arn:aws:lambda:region:account-id:function:function-name:function-version" + "arn:aws::lambda:us-east-1:123456789012:function:function-name:function-version" @@ -977 +977 @@ JSON - "Resource": "arn:aws:aoss:region:account-id:collection/collection-id" + "Resource": "arn:aws::aoss:us-east-1:123456789012:collection/collection-id" @@ -1074,2 +1074,2 @@ JSON - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" + "arn:aws::s3:::amzn-s3-demo-bucket", + "arn:aws::s3:::amzn-s3-demo-bucket/*" @@ -1085 +1085 @@ JSON - "arn:aws:kms:region:account-id:key/key-id" + "arn:aws::kms:us-east-1:123456789012:key/key-id" @@ -1089 +1089 @@ JSON - "kms:ViaService": "s3.region.amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -1092 +1092 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" @@ -1104 +1104 @@ JSON - "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name" + "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name" @@ -1112 +1112 @@ JSON - "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:*" + "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name:log-stream:*" @@ -1122 +1122 @@ JSON - "arn:aws:lambda:region:account-id:function:function-name:function-version" + "arn:aws::lambda:us-east-1:123456789012:function:function-name:function-version" @@ -1216,2 +1216,2 @@ JSON - "arn:aws:s3:::amzn-s3-demo-bucket",