AWS guardduty medium security documentation change
Summary
Clarified S3 permissions requirements and added multi-account management note
Security assessment
Explicitly specifies required IAM permissions (s3:GetObject) and restricts list management to administrator accounts in multi-account setups, addressing potential misconfiguration risks and privilege escalation vectors.
Diff
diff --git a/guardduty/latest/ug/guardduty-lists-prerequisites.md b/guardduty/latest/ug/guardduty-lists-prerequisites.md index 2af7c6beb..dfa9dee8b 100644 --- a//guardduty/latest/ug/guardduty-lists-prerequisites.md +++ b//guardduty/latest/ug/guardduty-lists-prerequisites.md @@ -13 +13 @@ GuardDuty uses entity lists and IP address lists to customize threat detection i -When you add entity lists, you store your trusted and threat intelligence lists in Amazon S3 buckets. For GuardDuty to read these lists and implement the custom threat detection, you must grant access permissions for your S3 buckets. +When you add entity lists, GuardDuty reads your trusted and threat intelligence lists from S3 buckets. The role you use to create entity lists must have the `s3:GetObject` permission for the S3 buckets contains these lists. @@ -15 +15,5 @@ When you add entity lists, you store your trusted and threat intelligence lists -Add the following `s3:GetObject` permission to your IAM policy and replace `amzn-s3-demo-bucket` with your S3 bucket location. +###### Note + +In a multi-account environment, only the GuardDuty administrator account can manage lists, which automatically apply to member accounts. + +If you don't already have the `s3:GetObject` permission for the S3 bucket location, then use the following example policy and replace `amzn-s3-demo-bucket` with your S3 bucket location. @@ -19 +23 @@ Add the following `s3:GetObject` permission to your IAM policy and replace `amzn - "Version": "2012-10-17", role="topic" + "Version": "2012-10-17",