AWS AmazonCloudWatch high security documentation change

Service: AmazonCloudWatch · 2025-08-28 · Security-related high

File: AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md

Summary

Removed an example S3 bucket policy configuration for cross-account log exports

Security assessment

The removed policy example contained cross-account permissions and conditional access controls. Removing it likely addresses potential over-permission risks by preventing users from copying outdated or insecure policy configurations that could expose S3 buckets to unauthorized access.

Diff

diff --git a/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md b/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md
index dec1cb5f7..4dbb7d62b 100644
--- a//AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md
+++ b//AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md
@@ -494,68 +493,0 @@ We recommend that you also include the account ID of the account where the S3 bu
-JSON
-    
-
-****
-    
-    
-        {
-        "Version": "2012-10-17",
-        "Statement": [
-          {
-              "Action": "s3:GetBucketAcl",
-              "Effect": "Allow",
-              "Resource": "arn:aws:s3:::<replaceable>&example-s3-bucket;</replaceable>",
-              "Principal": { "Service": "logs.<replaceable>&region_api_default;</replaceable>.amazonaws.com" },
-              "Condition": {
-                "StringEquals": {
-                    "aws:SourceAccount": [
-                        "<replaceable>&account_id_example;</replaceable>",
-                        "<replaceable>&ExampleAWSAccountNo1;</replaceable>"
-                    ]
-                },
-                "ArnLike": {
-                        "aws:SourceArn": [
-                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&account_id_example;</replaceable>:log-group:*",
-                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&ExampleAWSAccountNo1;</replaceable>:log-group:*"
-                        ]
-                }
-              }
-          },
-          {
-              "Action": "s3:PutObject",
-              "Effect": "Allow",
-              "Resource": "arn:aws:s3:::<replaceable>&example-s3-bucket;</replaceable>/*",
-              "Principal": { "Service": "logs.<replaceable>&region_api_default;</replaceable>.amazonaws.com" },
-              "Condition": {
-                "StringEquals": {
-                    "s3:x-amz-acl": "bucket-owner-full-control",
-                    "aws:SourceAccount": [
-                        "<replaceable>&account_id_example;</replaceable>",
-                        "<replaceable>&ExampleAWSAccountNo1;</replaceable>"
-                    ]
-                },
-                "ArnLike": {
-                        "aws:SourceArn": [
-                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&account_id_example;</replaceable>:log-group:*",
-                            "arn:aws:logs:<replaceable>&region_api_default;</replaceable>:<replaceable>&ExampleAWSAccountNo1;</replaceable>:log-group:*"
-                        ]
-                }
-              }
-          },
-          {
-              "Effect": "Allow",
-              "Principal": {
-                "AWS": "arn:aws:iam::<replaceable>&ExampleAWSAccountNo1;</replaceable>:role/<replaceable>role_name</replaceable>"
-              },
-              "Action": "s3:PutObject",
-              "Resource": "arn:aws:s3:::<replaceable>&example-s3-bucket;</replaceable>/*",
-              "Condition": {
-                "StringEquals": {
-                    "s3:x-amz-acl": "bucket-owner-full-control"
-                }
-              }
-           }
-        ]
-    }
-    
-    
-