AWS AmazonS3 documentation change
Summary
Removed multiple IAM role trust policies and access grant examples
Security assessment
Removal of complex IAM examples but no explicit security context. Policies involved sensitive permissions but deletion doesn't indicate security remediation.
Diff
diff --git a/AmazonS3/latest/userguide/access-grants-location-register.md b/AmazonS3/latest/userguide/access-grants-location-register.md index 28479009d..3c61465c9 100644 --- a//AmazonS3/latest/userguide/access-grants-location-register.md +++ b//AmazonS3/latest/userguide/access-grants-location-register.md @@ -46,32 +45,0 @@ _TestRolePolicy.json_ -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "TestRolePolicy", - "Effect": "Allow", - "Principal": { - "Service":"access-grants.s3.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:SetSourceIdentity" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:SourceAccount":"accountId", - "aws:SourceArn":"arn:aws:s3:region:accountId:access-grants/default" - } - } - } - ] - } - - - @@ -80,50 +47,0 @@ Alternatively, for an IAM Identity Center use case, use the following policy whi -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "TestRolePolicyIdentityCenter", - "Effect": "Allow", - "Principal": { - "Service":"access-grants.s3.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:SetSourceIdentity" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:SourceAccount":"111122223333", - "aws:SourceArn":"arn:aws:s3:aws-region:111122223333:access-grants/default" - } - } - }, - { - "Sid": "Stmt1234567891012", - "Effect": "Allow", - "Principal": { - "Service": "access-grants.s3.amazonaws.com" - }, - "Action": "sts:SetContext", - "Resource": "*", - "Condition":{ - "StringEquals":{ - "aws:SourceAccount":"111122223333", - "aws:SourceArn":"arn:aws:s3:aws-region:111122223333:access-grants/default" - }, - "ForAllValues:ArnEquals": { - "sts:RequestContextProviders":"arn:aws:iam::111122223333:contextProvider/IdentityCenter" - } - } - } - ] - } - - - @@ -274,22 +191,0 @@ _TestRolePolicy.json_ -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Stmt1234567891011", - "Action": ["sts:AssumeRole", "sts:SetSourceIdentity"], - "Effect": "Allow", - "Principal": {"Service":"access-grants.s3.amazonaws.com"}, - "Resource": "*" - } - ] - } - - - @@ -346,83 +241,0 @@ _iam-policy.json_ -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Sid": "ObjectLevelReadPermissions", - "Effect":"Allow", - "Action":[ - "s3:GetObject", - "s3:GetObjectVersion", - "s3:GetObjectAcl", - "s3:GetObjectVersionAcl", - "s3:ListMultipartUploadParts" - ], - "Resource":[ - "arn:aws:s3:::*" - ], - "Condition":{ - "StringEquals": { "aws:ResourceAccount": "accountId" }, - "ArnEquals": { - "s3:AccessGrantsInstanceArn": ["arn:aws:s3:region:accountId:access-grants/default"] - } - } - }, - { - "Sid": "ObjectLevelWritePermissions", - "Effect":"Allow", - "Action":[ - "s3:PutObject", - "s3:PutObjectAcl", - "s3:PutObjectVersionAcl", - "s3:DeleteObject", - "s3:DeleteObjectVersion", - "s3:AbortMultipartUpload" - ], - "Resource":[ - "arn:aws:s3:::*" - ], - "Condition":{ - "StringEquals": { "aws:ResourceAccount": "111122223333" }, - "ArnEquals": { - "s3:AccessGrantsInstanceArn": ["arn:aws:s3:aws-region:111122223333:access-grants/default"] - } - } - }, - { - "Sid": "BucketLevelReadPermissions", - "Effect":"Allow", - "Action":[ - "s3:ListBucket" - ], - "Resource":[ - "arn:aws:s3:::*" - ], - "Condition":{ - "StringEquals": { "aws:ResourceAccount": "111122223333" }, - "ArnEquals": { - "s3:AccessGrantsInstanceArn": ["arn:aws:s3:aws-region:111122223333:access-grants/default"] - } - } - }, - { - "Sid": "KMSPermissions", - "Effect":"Allow", - "Action":[ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource":[ - "*" - ] - } - ] - } - - -