AWS efs documentation change
Summary
Updated IAM policy examples with concrete ARN values and improved formatting
Security assessment
The change provides specific ARN examples for cross-account replication policies, improving clarity of security configurations but does not address any specific vulnerability. Proper ARN configuration is crucial for security but this is a documentation improvement rather than a vulnerability fix.
Diff
diff --git a/efs/latest/ug/cross-account-replication.md b/efs/latest/ug/cross-account-replication.md index 08f42c69c..0ddff90ca 100644 --- a//efs/latest/ug/cross-account-replication.md +++ b//efs/latest/ug/cross-account-replication.md @@ -39,0 +40,6 @@ The following are the general steps for creating an IAM role with custom trust p +JSON + + +**** + + @@ -53 +59,8 @@ The following are the general steps for creating an IAM role with custom trust p - 2. After you have created the role, assign the following permissions for the role. Replace `DESTINATION_FILE_SYSTEM_ARN` with the ARN of the destination file system and replace `SOURCE_FILE_SYSTEM_ARN` with the ARN of the source file system. For instructions on assigning permissions to the role, see [Creating policies using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor). + + 2. After you create the role, assign the following permissions for the role. Replace `arn:aws:elasticfilesystem:`us-east-1`:`111122223333`:file-system/fs-0123456789abcdef1` with the ARN of the destination file system and replace `arn:aws:elasticfilesystem:`us-east-1`:`444455556666`:file-system/fs-5678910112hijkqr1` with the ARN of the source file system. For instructions on assigning permissions to the role, see [Creating policies using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor). + +JSON + + +**** + @@ -67 +80 @@ The following are the general steps for creating an IAM role with custom trust p - "Resource": "DESTINATION_FILE_SYSTEM_ARN" + "Resource": "arn:aws:elasticfilesystem:us-east-1:111122223333:file-system/fs-0123456789abcdef1" @@ -75 +88 @@ The following are the general steps for creating an IAM role with custom trust p - "Resource": "SOURCE_FILE_SYSTEM_ARN" + "Resource": "arn:aws:elasticfilesystem:us-east-1:444455556666:file-system/fs-5678910112hijkqr1" @@ -97 +111,7 @@ You cannot restrict access to resources over TLS connection. If you include the -To allow the source account permission to replicate to the destination file system and to delete the replication configuration from the destination account, the following policy must be created on the destination file system. Replace `SOURCE_ACCOUNT_ROOT` with the ID of the account that owns the source file system. +To allow the source account permission to replicate to the destination file system and to delete the replication configuration from the destination account, the following policy must be created on the destination file system. Replace `arn:aws:iam::`444455556666`:root` with the ID of the account that owns the source file system. Replace `arn:aws:elasticfilesystem:`us-east-1`:`111122223333`:file-system/fs-0123456789abcdef1` with the ARN of the destination file system + +JSON + + +**** + @@ -107 +127 @@ To allow the source account permission to replicate to the destination file syst - "AWS": "SOURCE_ACCOUNT_ROOT" + "AWS": "arn:aws:iam::444455556666:root" @@ -116 +136 @@ To allow the source account permission to replicate to the destination file syst - "Resource": "DESTINATION_FILE_SYSTEM_ARN" + "Resource": "arn:aws:elasticfilesystem:us-east-1:111122223333:file-system/fs-0123456789abcdef1" @@ -127 +147 @@ To allow the source account permission to replicate to the destination file syst - "Resource": "DESTINATION_FILE_SYSTEM_ARN" + "Resource": "arn:aws:elasticfilesystem:us-east-1:111122223333:file-system/fs-0123456789abcdef1" @@ -134 +155,7 @@ To allow the source account permission to replicate to the destination file syst -To allow the destination account permission to delete the replication configuration from the source account, you must assign the following policy to the source file system. Replace `DESTINATION_ACCOUNT_ROOT` with the ID of the account that owns the destination file system. +To allow the destination account permission to delete the replication configuration from the source account, you must assign the following policy to the source file system. Replace `arn:aws:iam::`111122223333`:root` with the ID of the account that owns the destination file system. Replace ` arn:aws:elasticfilesystem:`us-east-1`:`444455556666`:file-system/fs-5678910112hijkqr1` with the ARN of the source file system. + +JSON + + +**** + @@ -145 +172 @@ To allow the destination account permission to delete the replication configurat - "AWS": "DESTINATION_ACCOUNT_ROOT" + "AWS": "arn:aws:iam::111122223333:root" @@ -148 +175 @@ To allow the destination account permission to delete the replication configurat - "Resource": "SOURCE_FILE_SYSTEM_ARN" + "Resource": "arn:aws:elasticfilesystem:us-east-1:444455556666:file-system/fs-5678910112hijkqr1" @@ -161 +188 @@ To allow the destination account permission to delete the replication configurat - "Resource": "SOURCE_FILE_SYSTEM_ARN", + "Resource": "arn:aws:elasticfilesystem:us-east-1:444455556666:file-system/fs-5678910112hijkqr1",