AWS pcs documentation change
Summary
Restructured documentation about instance profile requirements, updated IAM role naming/path requirements, removed CLI examples for profile creation/listing, and clarified required permissions
Security assessment
The changes clarify security requirements for IAM roles (naming conventions, path requirements) and permissions policies needed for AWS PCS instance profiles. While this improves security documentation, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/pcs/latest/userguide/security-instance-profiles.md b/pcs/latest/userguide/security-instance-profiles.md index 0c2217bcf..739809231 100644 --- a//pcs/latest/userguide/security-instance-profiles.md +++ b//pcs/latest/userguide/security-instance-profiles.md @@ -5 +5 @@ -Instance Profile RequirementsAdditional policiesCreating an instance profileList instance profiles for AWS PCS +RequirementsAdditional policies @@ -9 +9 @@ Instance Profile RequirementsAdditional policiesCreating an instance profileList -Applications that run on an EC2 instance must include AWS credentials in any AWS API requests they make. We recommended you use an IAM role to manage temporary credentials on the EC2 instance. You can define an instance profile to do this, and attach it to your instances. For more information, see [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) in the _Amazon Elastic Compute Cloud User Guide_. +Applications that run on an EC2 instance must include AWS credentials in any AWS API requests they make. We recommend you use an IAM role to manage temporary credentials on the EC2 instance. You can define an instance profile to do this, and attach it to your instances. For more information, see [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) in the _Amazon Elastic Compute Cloud User Guide_. @@ -17 +17 @@ You must specify the Amazon Resource Name (ARN) of an instance profile when you -## Instance Profile Requirements +## Requirements @@ -19 +19 @@ You must specify the Amazon Resource Name (ARN) of an instance profile when you -###### Instance Profile ARN +### IAM role of the instance profile @@ -21 +21 @@ You must specify the Amazon Resource Name (ARN) of an instance profile when you -The IAM role name part of the ARN must either begin with `AWSPCS` or contain `/aws-pcs/` in its path: +The IAM role associated with the instance profile must have `/aws-pcs/` in its path, or its name must start with `AWSPCS`. @@ -23 +23 @@ The IAM role name part of the ARN must either begin with `AWSPCS` or contain `/a - * `arn:aws:iam::*:instance-profile/AWSPCS-example-role-1` and +###### Example IAM role ARNs @@ -25 +25 @@ The IAM role name part of the ARN must either begin with `AWSPCS` or contain `/a - * `arn:aws:iam::*:instance-profile/aws-pcs/example-role-2`. + * `arn:aws:iam::*:role/AWSPCS-example-role-1` @@ -26,0 +27 @@ The IAM role name part of the ARN must either begin with `AWSPCS` or contain `/a + * `arn:aws:iam::*:role/aws-pcs/example-role-2` @@ -30 +30,0 @@ The IAM role name part of the ARN must either begin with `AWSPCS` or contain `/a -###### Note @@ -32 +32,3 @@ The IAM role name part of the ARN must either begin with `AWSPCS` or contain `/a -If you use the AWS CLI, provide a `--path` value to `iam create-instance-profile` to include `/aws-pcs/` in the ARN path. For example: +### Permissions + +The IAM role associated with the instance profile for AWS PCS must include the following policy. @@ -33,0 +36 @@ If you use the AWS CLI, provide a `--path` value to `iam create-instance-profile +JSON @@ -35 +37,0 @@ If you use the AWS CLI, provide a `--path` value to `iam create-instance-profile - aws iam create-instance-profile --path /aws-pcs/ --instance-profile-name example-role-2 @@ -37 +39 @@ If you use the AWS CLI, provide a `--path` value to `iam create-instance-profile -###### Permissions +**** @@ -39 +40,0 @@ If you use the AWS CLI, provide a `--path` value to `iam create-instance-profile -At minimum, the instance profile for AWS PCS must include the following policy. It allows compute nodes to notify the AWS PCS service when they become operational. @@ -58 +59 @@ At minimum, the instance profile for AWS PCS must include the following policy. -You may consider adding managed policies to the instance profile. For example: +Consider adding managed policies to the instance profile. For example: @@ -71,18 +71,0 @@ You can also include your own IAM policies that support your specific use case. -## Creating an instance profile - -To create an instance profile, you can: - - * Select **Create a basic profile** when you create a compute node group to have AWS PCS create one for you with the minimum required policy. - - * Create an instance profile directly from the Amazon EC2 console. For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the _AWS Identity and Access Management User Guide_. - - - - -## List instance profiles for AWS PCS - -You can use the following AWS CLI command to list the instance profiles in an AWS Region that meet AWS PCS name requirements. Replace `us-east-1` with the appropriate AWS Region. - - - aws iam list-instance-profiles --region us-east-1 --query "InstanceProfiles[?starts_with(InstanceProfileName, 'AWSPCS') || contains(Path, '/aws-pcs/')].[InstanceProfileName]" --output text - @@ -97 +80 @@ Minimum permissions -Troubleshooting +Create an instance profile