AWS kendra documentation change

Service: kendra · 2025-08-28 · Documentation low

File: kendra/latest/dg/tutorial-search-metadata-create-index-ingest.md

Summary

Removed JSON examples of IAM policies for CloudWatch, logs, and S3/Kendra permissions

Security assessment

The removed policies were examples of required permissions but do not indicate security vulnerabilities. No evidence of security issues being addressed.

Diff

diff --git a/kendra/latest/dg/tutorial-search-metadata-create-index-ingest.md b/kendra/latest/dg/tutorial-search-metadata-create-index-ingest.md
index 1ffbf817d..2ce077596 100644
--- a//kendra/latest/dg/tutorial-search-metadata-create-index-ingest.md
+++ b//kendra/latest/dg/tutorial-search-metadata-create-index-ingest.md
@@ -130,42 +129,0 @@ The ARN has a format similar to `arn:aws:iam::123456789012:role/kendra-role`. Yo
-JSON
-    
-
-****
-    
-        
-                {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                    "Effect": "Allow",
-                    "Action": "cloudwatch:PutMetricData",
-                    "Resource": "*",
-                    "Condition": {
-                        "StringEquals": {
-                            "cloudwatch:namespace": "Kendra"
-                        }
-                    }
-                },
-                {
-                    "Effect": "Allow",
-                    "Action": "logs:DescribeLogGroups",
-                    "Resource": "*"
-                },
-                {
-                    "Effect": "Allow",
-                    "Action": "logs:CreateLogGroup",
-                    "Resource": "arn:aws:logs:aws-region:aws-account-id:log-group:/aws/kendra/*"
-                },
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "logs:DescribeLogStreams",
-                        "logs:CreateLogStream",
-                        "logs:PutLogEvents"
-                    ],
-                    "Resource": "arn:aws:logs:aws-region:aws-account-id:log-group:/aws/kendra/*:log-stream:*"
-                }
-            ]
-        }
-        
-
@@ -370,42 +327,0 @@ While the index is being created, you update your Amazon Kendra IAM role to allo
-JSON
-    
-
-****
-    
-    
-        {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Action": [
-                    "s3:GetObject"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::amzn-s3-demo-bucket/*"
-                ],
-                "Effect": "Allow"
-            },
-            {
-                "Action": [
-                    "s3:ListBucket"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::amzn-s3-demo-bucket"
-                ],
-                "Effect": "Allow"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "kendra:BatchPutDocument",
-                    "kendra:BatchDeleteDocument",
-                    "kendra:ListDataSourceSyncJobs"
-                ],
-                "Resource": [
-                    "arn:aws:kendra:aws-region:aws-account-id:index/kendra-index-id"
-                ]
-            }
-        ]
-    }
-    
-