AWS greengrass documentation change
Summary
Removed detailed JSON examples of IAM policies for Greengrass Core device authentication and client device authentication
Security assessment
The removed content consists of example IAM policies, which are documentation examples rather than addressing specific security vulnerabilities. No evidence of security issue remediation in the change.
Diff
diff --git a/greengrass/v2/developerguide/device-auth.md b/greengrass/v2/developerguide/device-auth.md index 5f84b9bf0..40d3d31f4 100644 --- a//greengrass/v2/developerguide/device-auth.md +++ b//greengrass/v2/developerguide/device-auth.md @@ -410,59 +409,0 @@ When you install the AWS IoT Greengrass Core software, you create and attach a s -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "iot:Connect" - ], - "Resource": "arn:aws:iot:us-east-1:123456789012:client/core-device-thing-name*" - }, - { - "Effect": "Allow", - "Action": [ - "iot:Receive", - "iot:Publish" - ], - "Resource": [ - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name/greengrass/health/json", - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name/greengrassv2/health/json", - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name/jobs/*", - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name/shadow/*" - ] - }, - { - "Effect": "Allow", - "Action": [ - "iot:Subscribe" - ], - "Resource": [ - "arn:aws:iot:us-east-1:123456789012:topicfilter/$aws/things/core-device-thing-name/jobs/*", - "arn:aws:iot:us-east-1:123456789012:topicfilter/$aws/things/core-device-thing-name/shadow/*" - ] - }, - { - "Effect": "Allow", - "Action": "iot:AssumeRoleWithCertificate", - "Resource": "arn:aws:iot:us-east-1:123456789012:rolealias/token-exchange-role-alias-name" - }, - { - "Effect": "Allow", - "Action": [ - "greengrass:GetComponentVersionArtifact", - "greengrass:ResolveComponentCandidates", - "greengrass:GetDeploymentConfiguration", - "greengrass:ListThingGroupsForCoreDevice" - ], - "Resource": "*" - } - ] - } - - @@ -478,68 +418,0 @@ The following example policy includes the minimum set of actions required to sup -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "iot:Publish" - ], - "Resource": [ - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name-gci/shadow/get" - ] - }, - { - "Effect": "Allow", - "Action": [ - "iot:Subscribe" - ], - "Resource": [ - "arn:aws:iot:us-east-1:123456789012:topicfilter/$aws/things/core-device-thing-name-gci/shadow/update/delta", - "arn:aws:iot:us-east-1:123456789012:topicfilter/$aws/things/core-device-thing-name-gci/shadow/get/accepted" - ] - }, - { - "Effect": "Allow", - "Action": [ - "iot:Receive" - ], - "Resource": [ - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name-gci/shadow/update/delta", - "arn:aws:iot:us-east-1:123456789012:topic/$aws/things/core-device-thing-name-gci/shadow/get/accepted" - ] - }, - { - "Effect": "Allow", - "Action": [ - "greengrass:PutCertificateAuthorities", - "greengrass:VerifyClientDeviceIdentity" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "greengrass:VerifyClientDeviceIoTCertificateAssociation" - ], - "Resource": "arn:aws:iot:us-east-1:123456789012:thing/*" - }, - { - "Effect": "Allow", - "Action": [ - "greengrass:GetConnectivityInfo", - "greengrass:UpdateConnectivityInfo" - ], - "Resource": [ - "arn:aws:iot:us-east-1:123456789012:thing/core-device-thing-name" - ] - } - ] - } - -