AWS AWSCloudFormation documentation change
Summary
Replaced custom IAM role configuration with service-linked role ARN for Application Auto Scaling
Security assessment
The change promotes using AWS-managed service-linked roles which follow security best practices by providing predefined permissions. However, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/quickref-dynamodb.md b/AWSCloudFormation/latest/UserGuide/quickref-dynamodb.md index bff481db7..1a462e53e 100644 --- a//AWSCloudFormation/latest/UserGuide/quickref-dynamodb.md +++ b//AWSCloudFormation/latest/UserGuide/quickref-dynamodb.md @@ -94,6 +94 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - "RoleARN": { - "Fn::GetAtt": [ - "ScalingRole", - "Arn" - ] - }, + "RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster" }, @@ -104,45 +98,0 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - "ScalingRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": [ - "application-autoscaling.amazonaws.com" - ] - }, - "Action": [ - "sts:AssumeRole" - ] - } - ] - }, - "Path": "/", - "Policies": [ - { - "PolicyName": "root", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "dynamodb:DescribeTable", - "dynamodb:UpdateTable", - "cloudwatch:PutMetricAlarm", - "cloudwatch:DescribeAlarms", - "cloudwatch:GetMetricStatistics", - "cloudwatch:SetAlarmState", - "cloudwatch:DeleteAlarms" - ], - "Resource": "*" - } - ] - } - } - ] - } - }, @@ -179,2 +129 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - AttributeName: "ArtistId" + - AttributeName: "ArtistId" @@ -182,2 +131 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - AttributeName: "Concert" + - AttributeName: "Concert" @@ -185,2 +133 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - AttributeName: "TicketSales" + - AttributeName: "TicketSales" @@ -189,2 +136 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - AttributeName: "ArtistId" + - AttributeName: "ArtistId" @@ -192,2 +138 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - AttributeName: "Concert" + - AttributeName: "Concert" @@ -196,2 +141 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - IndexName: "GSI" + - IndexName: "GSI" @@ -199,2 +143 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - - - AttributeName: "TicketSales" + - AttributeName: "TicketSales" @@ -219 +162,2 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - RoleARN: !GetAtt ScalingRole.Arn + RoleARN: + Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable' @@ -222,31 +165,0 @@ This example sets up Application Auto Scaling for a `AWS::DynamoDB::Table` resou - ScalingRole: - Type: AWS::IAM::Role - Properties: - AssumeRolePolicyDocument: - Version: "2012-10-17" - Statement: - - - Effect: "Allow" - Principal: - Service: - - application-autoscaling.amazonaws.com - Action: - - "sts:AssumeRole" - Path: "/" - Policies: - - - PolicyName: "root" - PolicyDocument: - Version: "2012-10-17" - Statement: - - - Effect: "Allow" - Action: - - "dynamodb:DescribeTable" - - "dynamodb:UpdateTable" - - "cloudwatch:PutMetricAlarm" - - "cloudwatch:DescribeAlarms" - - "cloudwatch:GetMetricStatistics" - - "cloudwatch:SetAlarmState" - - "cloudwatch:DeleteAlarms" - Resource: "*"