AWS firehose documentation change
Summary
Multiple corrections to AWS resource ARN formats (fixing missing service names like 'arn:aws:firehose' instead of 'arn:aws::firehose'), removal of redundant formatting markers (****), and standardization of JSON policy examples including IAM role configurations, KMS key references, and resource ARN patterns.
Security assessment
The changes primarily correct ARN formatting errors and improve policy examples, but there is no evidence of addressing a specific security vulnerability. The modifications enhance documentation accuracy for security-related IAM policies and resource permissions, which helps prevent misconfigurations, but do not directly patch a disclosed security issue.
Diff
diff --git a/firehose/latest/dev/controlling-access.md b/firehose/latest/dev/controlling-access.md index afcea3727..e50c9f124 100644 --- a//firehose/latest/dev/controlling-access.md +++ b//firehose/latest/dev/controlling-access.md @@ -66,6 +65,0 @@ To give your application access to your Firehose stream, use a policy similar to -JSON - - -**** - - @@ -85 +79 @@ JSON - "arn:aws::firehose:us-east-1:111122223333:deliverystream/delivery-stream-name" + "arn:aws:firehose:us-east-1:123456789012:deliverystream/delivery-stream-name" @@ -96,6 +88,0 @@ If the source of your Firehose stream is a private Amazon MSK cluster, then use -JSON - - -**** - - @@ -116 +103 @@ JSON - "Resource": "arn:aws::kafka:us-east-1:123456789012:cluster/*" + "Resource": "cluster-arn" @@ -134,6 +119,0 @@ Amazon Data Firehose uses an IAM role for all the permissions that the Firehose -JSON - - -**** - - @@ -143,2 +123 @@ JSON - "Statement": [ - { + "Statement": [{ @@ -150,3 +129,2 @@ JSON - "Action": "sts:AssumeRole" - } - ] + "Action": "sts:AssumeRole", + }] @@ -158,6 +134,0 @@ If you choose Amazon MSK as the source for your Firehose stream, you must specif -JSON - - -**** - - @@ -184,6 +153,0 @@ Make sure that this role that grants Amazon Data Firehose permissions to ingest -JSON - - -**** - - @@ -201 +165 @@ JSON - "Resource": "arn:aws::Firehose:us-east-1:123456789012:CLUSTER-ARN" + "Resource": "CLUSTER-ARN" @@ -210 +174 @@ JSON - "Resource": "arn:aws::Firehose:us-east-1:123456789012:TOPIC-ARN" + "Resource": "TOPIC-ARN" @@ -246,6 +208,0 @@ Use the following access policy to enable Amazon Data Firehose to access your S3 -JSON - - -**** - - @@ -280 +237 @@ JSON - "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name" + "Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/stream-name" @@ -289 +246 @@ JSON - "arn:aws::kms:us-east-1:123456789012:key/key-id" + "arn:aws:kms:us-east-1:123456789012:key/key-id" @@ -306 +263 @@ JSON - "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name:log-stream:log-stream-name" + "arn:aws:logs:us-east-1:123456789012:log-group:log-group-name:log-stream:log-stream-name" @@ -368,6 +323,0 @@ Create a policy and choose **JSON** in the policy editor. Add the following inli -JSON - - -**** - - @@ -387,5 +337,5 @@ JSON - "arn:aws::glue:us-east-1123456789012:catalog/s3tablescatalog/*", - "arn:aws::glue:us-east-1:123456789012:catalog/s3tablescatalog", - "arn:aws::glueus-east-1:123456789012:catalog", - "arn:aws::glueus-east-1:123456789012:database/*", - "arn:aws::glueus-east-1:123456789012:table/*/*" + "arn:aws:glue:us-east-1:123456789012:catalog/s3tablescatalog/*", + "arn:aws:glue:us-east-1:123456789012:catalog/s3tablescatalog", + "arn:aws:glue:us-east-1:123456789012:catalog", + "arn:aws:glue:us-east-1:123456789012:database/*", + "arn:aws:glue:us-east-1:123456789012:table/*/*" @@ -419 +369 @@ JSON - "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/<stream-name>" + "Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/<stream-name>" @@ -437 +387 @@ JSON - "arn:aws::kms:us-east-1:123456789012:key/KMS-key-id>" + "arn:aws:kms:us-east-1:123456789012:key/<KMS-key-id>" @@ -455 +405 @@ JSON - "arn:aws::logs:us-east-1:123456789012:log-group:log-group-name>:log-stream:log-stream-name>" + "arn:aws:logs:us-east-1:123456789012:log-group:log-group-name>:log-stream:<log-stream-name>" @@ -466 +416 @@ JSON - "arn:aws::lambda:us-east-1:123456789012:function:function-name>:function-version>" + "arn:aws:lambda:us-east-1:123456789012:function:<function-name>:<function-version>" @@ -493,6 +441,0 @@ You must have an IAM role before you create a Firehose stream and Apache Iceberg -JSON - - -**** - - @@ -511,3 +454,3 @@ JSON - "arn:aws::glue:<us-east-1>:123456789012>:catalog", - "arn:aws::glue:<us-east-1>:123456789012>:database/*", - "arn:aws::glue:<us-east-1>:123456789012>:table/*/*" + "arn:aws:glue:us-east-1:123456789012:catalog", + "arn:aws:glue:us-east-1:123456789012:database/*", + "arn:aws:glue:us-east-1:123456789012:table/*/*" @@ -529 +472 @@ JSON - "arn:aws::s3:::amzn-s3-demo-bucket/*" + "arn:aws:s3:::amzn-s3-demo-bucket/*" @@ -540 +483 @@ JSON - "Resource": "arn:aws::kinesis:us-east-1:123456789012:stream/stream-name>" + "Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/stream-name>" @@ -549 +492 @@ JSON - "arn:aws::kms:<us-east-1>:<123456789012>:key/<key-id>" + "arn:aws:kms:us-east-1:123456789012:key/key-id>" @@ -553 +496 @@ JSON - "kms:ViaService": "s3.us-east-1.amazonaws.com" + "kms:ViaService": "s3.region.amazonaws.com" @@ -556 +499 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" @@ -566 +509 @@ JSON - "arn:aws::logs:<us-east-1:123456789012>:log-group:log-group-name>:log-stream:log-stream-name>" + "arn:aws:logs:us-east-1:123456789012:log-group:log-group-name>:log-stream:log-stream-name>" @@ -576 +519 @@ JSON - "arn:aws::lambda:us-east-1:123456789012:function:function-name>:function-version>" + "arn:aws:lambda:us-east-1:123456789012:function:function-name:function-version" @@ -621,6 +562,0 @@ Use the following access policy to enable Amazon Data Firehose to access your S3 -JSON - - -**** - - @@ -654 +590 @@ JSON - "arn:aws::kms:US West (Oregon):123456789012:key/key-id" + "arn:aws:kms:us-east-1:123456789012:key/key-id" @@ -658 +594 @@ JSON - "kms:ViaService": "s3.US West (Oregon).amazonaws.com" + "kms:ViaService": "s3.us-east-1.amazonaws.com" @@ -673 +609 @@ JSON - "Resource": "arn:aws::kinesis:US West (Oregon):123456789012:stream/stream-name" + "Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/stream-name" @@ -681 +617 @@ JSON - "arn:aws::logs:US West (Oregon):123456789012:log-group:log-group-name:log-stream:log-stream-name" + "arn:aws:logs:us-east-1:123456789012:log-group:log-group-name:log-stream:log-stream-name" @@ -691 +627 @@ JSON - "arn:aws::lambda:US West (Oregon):123456789012:function:function-name:function-version" + "arn:aws:lambda:us-east-1:123456789012:function:function-name:function-version" @@ -752,6 +686,0 @@ Use the following access policy to enable Amazon Data Firehose to access your S3 -JSON - - -**** - - @@ -773,2 +702,2 @@ JSON - "arn:aws::s3:::amzn-s3-demo-bucket", - "arn:aws::s3:::amzn-s3-demo-bucket/*" + "arn:aws:s3:::amzn-s3-demo-bucket", + "arn:aws:s3:::amzn-s3-demo-bucket/*" @@ -784 +713 @@ JSON - "arn:aws::kms:us-east-1:123456789012:key/key-id" + "arn:aws:kms:us-east-1:123456789012:key/key-id" @@ -791 +720 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" @@ -805,2 +734,2 @@ JSON - "arn:aws::es:us-east-1:123456789012:domain/domain-name", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/*" + "arn:aws:es:us-east-1:123456789012:domain/domain-name", + "arn:aws:es:us-east-1:123456789012:domain/domain-name/*" @@ -815,9 +744,9 @@ JSON - "arn:aws::es:us-east-1:123456789012:domain/domain-name/_all/_settings", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/_cluster/stats", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/index-name*/_mapping/type-name", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/_nodes", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/_nodes/stats", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/_nodes/*/stats", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/_stats", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/index-name*/_stats", - "arn:aws::es:us-east-1:123456789012:domain/domain-name/" + "arn:aws:es:us-east-1:123456789012:domain/domain-name/_all/_settings", + "arn:aws:es:us-east-1:123456789012:domain/domain-name/_cluster/stats", + "arn:aws:es:us-east-1:123456789012:domain/domain-name/index-name*/_mapping/type-name",