AWS kinesis-agent-windows documentation change
Summary
Updated IAM policy examples with specific region and account ID placeholders, added replacement instructions, and minor text formatting changes
Security assessment
The changes provide clearer examples and instructions for configuring IAM policies but do not address a specific security vulnerability. Enhanced documentation helps prevent accidental use of example values in production configurations, but there's no evidence of addressing an existing security flaw.
Diff
diff --git a/kinesis-agent-windows/latest/userguide/kaw-ds2s3-tutorial-step1.md b/kinesis-agent-windows/latest/userguide/kaw-ds2s3-tutorial-step1.md index 1c55288db..2ceb730a1 100644 --- a//kinesis-agent-windows/latest/userguide/kaw-ds2s3-tutorial-step1.md +++ b//kinesis-agent-windows/latest/userguide/kaw-ds2s3-tutorial-step1.md @@ -7 +7 @@ Configure IAM Policies and RolesCreate the Amazon S3 BucketCreate the Firehose D -# Step 1: Configure AWS Services +# Step 1: Configure AWS services @@ -31,0 +32,8 @@ Create the following policy, which authorizes Kinesis Agent for Windows to strea +Replace the example Region, `us-east-1` with the name of the AWS Region where the Firehose delivery stream will be created. Also, replace the example account, `123456789012` with the 12-digit account ID for the AWS account where the delivery stream will be created. + +JSON + + +**** + + @@ -43 +51 @@ Create the following policy, which authorizes Kinesis Agent for Windows to strea - "Resource": "arn:aws:firehose:_region_ :_account-id_ :deliverystream/log-delivery-stream" + "Resource": "arn:aws:firehose:us-east-1:123456789012:deliverystream/log-delivery-stream" @@ -49 +56,0 @@ Create the following policy, which authorizes Kinesis Agent for Windows to strea -Replace ``region`` with the name of the AWS Region where the Firehose delivery stream will be created (`us-east-1`, for example). Replace ``account-id`` with the 12-digit account ID for the AWS account where the delivery stream will be created. @@ -84 +91,15 @@ You can switch between the **Visual editor** and **JSON** tabs any time. However - 1. Using the previous procedure, create a policy named `firehose-s3-access-policy` that is defined using the following JSON: + 1. Using the previous procedure, create a policy named `firehose-s3-access-policy` that is defined using the following JSON. + +Replace the following in your IAM policy example: + + * The example Amazon S3 bucket name, `amzn-s3-demo-bucket` with a unique bucket name where the logs will be stored. + + * The example Region, `us-east-1` with the AWS Region where the CloudWatch Logs log group and log stream will be created. These are for logging any errors that occur during streaming the data to Amazon S3 via Firehose. + + * The example AWS account ID, `123456789012` with the 12-digit account ID for the account where the log group and log stream will be created. + +JSON + + +**** + @@ -101,2 +122,2 @@ You can switch between the **Visual editor** and **JSON** tabs any time. However - "arn:aws:s3:::_bucket-name_ ", - "arn:aws:s3:::_bucket-name_ /*" + "arn:aws:s3:::amzn-s3-demo-bucket", + "arn:aws:s3:::amzn-s3-demo-bucket/*" @@ -111 +132 @@ You can switch between the **Visual editor** and **JSON** tabs any time. However - "arn:aws:logs:_region_ :_account-id_ :log-group:firehose-error-log-group:log-stream:firehose-error-log-stream" + "arn:aws:logs:us-east-1:123456789012:log-group:firehose-error-log-group:log-stream:firehose-error-log-stream" @@ -118 +138,0 @@ You can switch between the **Visual editor** and **JSON** tabs any time. However -Replace ``bucket-name`` with a unique bucket name where the logs will be stored. Replace ``region`` with the AWS Region where the CloudWatch Logs log group and log stream will be created. These are for logging any errors that occur during streaming the data to Amazon S3 via Firehose. Replace ``account-id`` with the 12-digit account ID for the account where the log group and log stream will be created. @@ -124 +144 @@ Replace ``bucket-name`` with a unique bucket name where the logs will be stored. - 3. Choose the **AWS Service** role type, and then choose the **Kinesis** service. + 3. Choose the **AWS service** role type, and then choose the **Kinesis** service. @@ -141 +161 @@ Replace ``bucket-name`` with a unique bucket name where the logs will be stored. - 2. Choose the **AWS Service** role type, and then choose **EC2**. + 2. Choose the **AWS service** role type, and then choose **EC2**.