AWS elasticbeanstalk medium security documentation change

Service: elasticbeanstalk · 2025-08-28 · Security-related medium

File: elasticbeanstalk/latest/dg/vpc-vpce.policy.md

Summary

Removed multiple JSON policy examples that previously allowed wildcard (*) principals and broad S3 bucket permissions

Security assessment

The removed policies contained 'Principal: AWS: *' which creates over-permissive access. Removing these examples aligns with the documentation's recommendation to avoid wildcards, reducing potential misconfiguration risks.

Diff

diff --git a/elasticbeanstalk/latest/dg/vpc-vpce.policy.md b/elasticbeanstalk/latest/dg/vpc-vpce.policy.md
index 5c8ca7115..b21385793 100644
--- a//elasticbeanstalk/latest/dg/vpc-vpce.policy.md
+++ b//elasticbeanstalk/latest/dg/vpc-vpce.policy.md
@@ -221,28 +220,0 @@ We recommend that you avoid using wildcard characters (*) in place of specific R
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "AllowRequestsToCustomerItems",
-                "Effect": "Allow",
-                "Principal": {"AWS": "*"},
-                "Action": ["GetObject",
-                           "GetObjectAcl",
-                           "PutObject",
-                           "PutObjectAcl",
-                           "ListBucket"
-                           ],
-                "Resource": [
-                    "arn:aws:s3:::elasticbeanstalk-us-east-2-123456789012/*"
-                ]
-             }
-        ]
-    }
-    
-
@@ -267,23 +238,0 @@ The following example illustrates how to provide access to an S3 bucket with the
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "AllowRequestsToDockerRegistryAuth",
-                "Effect": "Allow",
-                "Principal": {"AWS": "*"},
-                "Action": ["GetObject"],
-                "Resource": [
-                    "arn:aws:s3:::amzn-s3-demo-bucket1"
-                ]
-             }
-        ]
-    }
-    
-
@@ -302,75 +250,0 @@ We recommend that you avoid using wildcard characters (*) in place of specific R
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "AllowRequestsToAWSResources",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "*"
-                },
-                "Action": [
-                    "s3:GetObject"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::elasticbeanstalk-platform-assets-us-east-2/*",
-                    "arn:aws:s3:::elasticbeanstalk-env-resources-us-east-2/*",
-                    "arn:aws:s3:::elasticbeanstalk-env-resources-us-east-2/*",
-                    "arn:aws:s3:::elasticbeanstalk-samples-us-east-2/*"
-                ]
-            },
-            {
-                "Sid": "AllowRequestsToCloudFormation",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "*"
-                },
-                "Action": [
-                    "s3:GetObject"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::cloudformation-waitcondition-us-east-2/*",
-                    "arn:aws:s3:::cloudformation-custom-resource-response-us-east-2/*"
-                ]
-            },
-            {
-                "Sid": "AllowRequestsToCustomerItems",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "*"
-                },
-                "Action": [
-                    "GetObject",
-                    "GetObjectAcl",
-                    "PutObject",
-                    "PutObjectAcl",
-                    "ListBucket"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::elasticbeanstalk-us-east-2-123456789012/*"
-                ]
-            },
-            {
-                "Sid": "AllowRequestsToDockerRegistryAuth",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "*"
-                },
-                "Action": [
-                    "GetObject"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::amzn-s3-demo-bucket1",
-                    ""
-                ]
-            }
-        ]
-    }
-    
-