AWS codecatalyst documentation change
Summary
Removed multiple JSON IAM policy examples from documentation sections describing various CodeCatalyst roles
Security assessment
The changes remove detailed IAM policy examples but do not explicitly reference security vulnerabilities or incidents. While IAM policies impact security posture, the removal of example configurations without replacement guidance appears to be a documentation cleanup rather than a direct response to a security issue. However, some removed policies contained overly broad permissions (e.g., Resource: '*' for cloudformation/iam/s3 actions), which could indicate security-conscious tightening of example policies.
Diff
diff --git a/codecatalyst/latest/userguide/ipa-iam-roles.md b/codecatalyst/latest/userguide/ipa-iam-roles.md index def134b08..2f7a95628 100644 --- a//codecatalyst/latest/userguide/ipa-iam-roles.md +++ b//codecatalyst/latest/userguide/ipa-iam-roles.md @@ -174,20 +173,0 @@ This role uses the following policy: -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [{ - "Action": [ - "s3:PutObject", - "iam:PassRole" - ], - "Resource": "resource_ARN", - "Effect": "Allow" - }] - } - - @@ -242,29 +221,0 @@ This role uses the following policy: -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "cloudformation:*", - "ecr:*", - "ssm:*", - "s3:*", - "iam:PassRole", - "iam:GetRole", - "iam:CreateRole", - "iam:AttachRolePolicy", - "iam:PutRolePolicy" - ], - "Resource": "*" - } - ] - } - - @@ -341,57 +291,0 @@ This role uses the following policy: -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:CompleteLifecycleAction", - "autoscaling:DeleteLifecycleHook", - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeLifecycleHooks", - "autoscaling:PutLifecycleHook", - "autoscaling:RecordLifecycleActionHeartbeat", - "autoscaling:CreateAutoScalingGroup", - "autoscaling:UpdateAutoScalingGroup", - "autoscaling:EnableMetricsCollection", - "autoscaling:DescribePolicies", - "autoscaling:DescribeScheduledActions", - "autoscaling:DescribeNotificationConfigurations", - "autoscaling:SuspendProcesses", - "autoscaling:ResumeProcesses", - "autoscaling:AttachLoadBalancers", - "autoscaling:AttachLoadBalancerTargetGroups", - "autoscaling:PutScalingPolicy", - "autoscaling:PutScheduledUpdateGroupAction", - "autoscaling:PutNotificationConfiguration", - "autoscaling:PutWarmPool", - "autoscaling:DescribeScalingActivities", - "autoscaling:DeleteAutoScalingGroup", - "ec2:DescribeInstances", - "ec2:DescribeInstanceStatus", - "ec2:TerminateInstances", - "tag:GetResources", - "sns:Publish", - "cloudwatch:DescribeAlarms", - "cloudwatch:PutMetricAlarm", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeInstanceHealth", - "elasticloadbalancing:RegisterInstancesWithLoadBalancer", - "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DescribeTargetHealth", - "elasticloadbalancing:RegisterTargets", - "elasticloadbalancing:DeregisterTargets" - ], - "Resource": "resource_ARN" - } - ] - } - - @@ -526,53 +419,0 @@ This role uses the following policy: -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "cloudwatch:DescribeAlarms", - "lambda:UpdateAlias", - "lambda:GetAlias", - "lambda:GetProvisionedConcurrencyConfig", - "sns:Publish" - ], - "Resource": "resource_ARN", - "Effect": "Allow" - }, - { - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": "arn:aws:s3:::/CodeDeploy/", - "Effect": "Allow" - }, - { - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": "", - "Condition": { - "StringEquals": { - "s3:ExistingObjectTag/UseWithCodeDeploy": "true" - } - }, - "Effect": "Allow" - }, - { - "Action": [ - "lambda:InvokeFunction" - ], - "Resource": "arn:aws:lambda:::function:CodeDeployHook_*", - "Effect": "Allow" - } - ] - } - - @@ -605,53 +445,0 @@ This role uses the following policy: -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "cloudwatch:DescribeAlarms", - "lambda:UpdateAlias", - "lambda:GetAlias", - "lambda:GetProvisionedConcurrencyConfig", - "sns:Publish" - ], - "Resource": "resource_ARN", - "Effect": "Allow" - }, - { - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": "arn:aws:s3:::/CodeDeploy/", - "Effect": "Allow" - }, - { - "Action": [ - "s3:GetObject",