AWS grafana documentation change

Service: grafana · 2025-08-28 · Documentation medium

File: grafana/latest/userguide/AMG-iot-twinmaker.md

Summary

Added concrete IAM policy examples and ARN formats for IoT TwinMaker integration

Security assessment

Improves security documentation by providing specific least-privilege policy examples but doesn't fix existing vulnerabilities

Diff

diff --git a/grafana/latest/userguide/AMG-iot-twinmaker.md b/grafana/latest/userguide/AMG-iot-twinmaker.md
index 77df8c46e..21002583b 100644
--- a//grafana/latest/userguide/AMG-iot-twinmaker.md
+++ b//grafana/latest/userguide/AMG-iot-twinmaker.md
@@ -50,0 +51,6 @@ With Amazon Managed Grafana, you can add AWS IoT TwinMaker, a powerful industria
+JSON
+    
+
+****
+    
+    
@@ -56 +62 @@ With Amazon Managed Grafana, you can add AWS IoT TwinMaker, a powerful industria
-            "Resource": "< TwinMaker Dashboard Role ARN >"
+            "Resource": "arn:aws:iam::111122223333:role/TwinMakerDashboardRole"
@@ -69,0 +77,6 @@ With Amazon Managed Grafana, you can add AWS IoT TwinMaker, a powerful industria
+JSON
+    
+
+****
+    
+    
@@ -91,64 +104,0 @@ The following is a minimal AWS IoT TwinMaker policy that you can attach to a das
-    
-     {
-        "Version": "2012-10-17",
-        "Statement": [
-          {
-            "Action": [
-              "iottwinmaker:ListWorkspaces"
-            ],
-            "Resource": [
-              "*"
-            ],
-            "Effect": "Allow"
-          },
-          {
-            "Action": [
-              "iottwinmaker:Get*",
-              "iottwinmaker:List*"
-            ],
-            "Resource": [
-              "IoTWorkspaceArn",
-              "IoTWorkspaceArn/*"
-            ],
-            "Effect": "Allow"
-          },
-          {
-            "Action": [
-              "kinesisvideo:Describe*",
-              "kinesisvideo:Get*",
-              "kinesisvideo:List*"
-            ],
-            "Resource": "*",
-            "Effect": "Allow"
-          },
-          {
-            "Action": [
-              "iotsitewise:Describe*",
-              "iotsitewise:List*",
-              "iotsitewise:Get*"
-            ],
-            "Resource": "*",
-            "Effect": "Allow"
-          },
-          {
-            "Action": "iotsitewise:BatchPutAssetPropertyValue",
-            "Resource": "*",
-            "Effect": "Allow",
-            "Condition": {
-              "StringEquals": {
-                "aws:ResourceTag/IoTWorkspaceId": "SiteWatch"
-              }
-            }
-          },
-          {
-            "Effect": "Allow",
-            "Action": ["s3:GetObject"],
-            "Resource": [
-              "S3BucketArn", 
-              "S3BucketArn/*"
-            ]
-          }
-        ]
-      }
-    
-