AWS AmazonCloudWatch medium security documentation change
Summary
Removed multiple JSON IAM policy examples that previously showed detailed permissions for canary operations including S3 access, logging, XRay, CloudWatch metrics, KMS decryption, and EC2 network interface management
Security assessment
The removed policies contained security-sensitive configurations including wildcard resource permissions (*) for actions like s3:ListAllMyBuckets and xray:PutTraceSegments, as well as KMS decryption permissions. Removing these examples could indicate they were overly permissive or contained insecure patterns that should not be recommended. This change helps prevent users from deploying policies with excessive privileges that could lead to privilege escalation or unintended resource access.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_CanaryPermissions.md b/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_CanaryPermissions.md index 7d0574bb1..6d37e14ad 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_CanaryPermissions.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_CanaryPermissions.md @@ -38,64 +37,0 @@ Additionally, the canary's IAM role needs one of the following statements. -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "s3:PutObject", - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::path/to/your/s3/bucket/canary/results/folder" - ] - }, - { - "Effect": "Allow", - "Action": [ - "s3:GetBucketLocation" - ], - "Resource": [ - "arn:aws:s3:::name/of/the/s3/bucket/that/contains/canary/results" - ] - }, - { - "Effect": "Allow", - "Action": [ - "logs:CreateLogStream", - "logs:PutLogEvents", - "logs:CreateLogGroup" - ], - "Resource": [ - "arn:aws:logs:us-east-1:canary_123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" - ] - }, - { - "Effect": "Allow", - "Action": [ - "s3:ListAllMyBuckets", - "xray:PutTraceSegments" - ], - "Resource": [ - "*" - ] - }, - { - "Effect": "Allow", - "Resource": "*", - "Action": "cloudwatch:PutMetricData", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": "CloudWatchSynthetics" - } - } - } - ] - } - - @@ -104,79 +39,0 @@ JSON -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "s3:PutObject", - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder" - ] - }, - { - "Effect": "Allow", - "Action": [ - "s3:GetBucketLocation" - ], - "Resource": [ - "arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results" - ] - }, - { - "Effect": "Allow", - "Action": [ - "logs:CreateLogStream", - "logs:PutLogEvents", - "logs:CreateLogGroup" - ], - "Resource": [ - "arn:aws:logs:us-east-1:canary_123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" - ] - }, - { - "Effect": "Allow", - "Action": [ - "s3:ListAllMyBuckets", - "xray:PutTraceSegments" - ], - "Resource": [ - "*" - ] - }, - { - "Effect": "Allow", - "Resource": "*", - "Action": "cloudwatch:PutMetricData", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": "CloudWatchSynthetics" - } - } - }, - { - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "arn:aws:kms:us-east-1:KMS_key_123456789012:key/KMS_key_id", - "Condition": { - "StringEquals": { - "kms:ViaService": [ - "s3.us-east-1.amazonaws.com" - ] - } - } - } - ] - } - - @@ -185,75 +41,0 @@ JSON -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "s3:PutObject", - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder" - ] - }, - { - "Effect": "Allow", - "Action": [ - "s3:GetBucketLocation" - ], - "Resource": [ - "arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results" - ] - }, - { - "Effect": "Allow", - "Action": [ - "logs:CreateLogStream", - "logs:PutLogEvents", - "logs:CreateLogGroup" - ], - "Resource": [ - "arn:aws:logs:us-east-1:canary_123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" - ] - }, - { - "Effect": "Allow", - "Action": [ - "s3:ListAllMyBuckets", - "xray:PutTraceSegments" - ], - "Resource": [ - "*" - ] - },