AWS lexv2 documentation change
Summary
Removed multiple JSON policy examples related to bot creation, automated testing, KMS usage, resource policy management, migration permissions, and bot replica operations
Security assessment
The changes remove existing IAM policy examples but do not indicate any specific security vulnerability being addressed. The examples were general security documentation about permissions management rather than fixes for security issues.
Diff
diff --git a/lexv2/latest/dg/security_iam_id-based-policy-examples.md b/lexv2/latest/dg/security_iam_id-based-policy-examples.md index 8d953ce0d..298eecb19 100644 --- a//lexv2/latest/dg/security_iam_id-based-policy-examples.md +++ b//lexv2/latest/dg/security_iam_id-based-policy-examples.md @@ -147,23 +146,0 @@ This example shows an example policy that allows IAM users to create and update -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "lex:CreateBot", - "lex:UpdateBot". - "iam:PassRole" - ], - "Effect": "Allow", - "Resource": ["arn:aws:lex:Region:123412341234:bot/*] - } - ] - } - - @@ -174,38 +150,0 @@ This example shows an example policy that allows IAM users to run the Automated -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "s3:GetObject", - "s3:ListBucket" - ], - "Resource": [ - "arn:aws:s3:::<customer-bucket>/<bucketName>", - # Resource should point to the bucket or an explicit folder. - # Provide this to read the entire bucket - "arn:aws:s3:::<customer-bucket>/<bucketName>/*", - # Provide this to read a specifc folder - "arn:aws:s3:::<customer-bucket>/<bucketName>/<pathFormat>/*" - ] - }, - { - # Use this if your S3 bucket is encrypted with a KMS key. - "Effect": "Allow", - "Action": [ - "kms:Decrypt" - ], - "Resource": [ - "arn:aws:kms:<Region>:<customerAccountId>:key/<kmsKeyId>" - ] - ] - } - - @@ -216,30 +154,0 @@ This example shows an example policy that allows IAM users to use a AWS KMS cust -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Id": "sample-policy", - "Statement": [ - { - "Sid": "Allow Lex access", - "Effect": "Allow", - "Principal": { - "Service": "lexv2.amazonaws.com" - }, - "Action": [ - # If the key is for encryption - "kms:Encrypt", - "kms:GenerateDataKey" - # If the key is for decryption - "kms:Decrypt" - ], - "Resource": "*" - } - ] - } - - @@ -313,27 +221,0 @@ The following example grants permission for a specific user to manage the resour -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "ResourcePolicyEditor", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::123456789012:role/ResourcePolicyEditor" - }, - "Action": [ - "lex:CreateResourcePolicy", - "lex:UpdateResourcePolicy", - "lex:DeleteResourcePolicy", - "lex:DescribeResourcePolicy" - ] - } - ] - } - - @@ -494,70 +375,0 @@ The following IAM permission policy allows a user to start migrating a bot from -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "startMigration", - "Effect": "Allow", - "Action": "lex:StartMigration", - "Resource": "arn:aws:lex:>Region<:>123456789012<:bot:*" - }, - { - "Sid": "passRole", - "Effect": "Allow", - "Action": "iam:PassRole", - "Resource": "arn:aws:iam::>123456789012<:role/>v2 bot role<" - }, - { - "Sid": "allowOperations", - "Effect": "Allow", - "Action": [ - "lex:CreateBot", - "lex:CreateIntent", - "lex:UpdateSlot", - "lex:DescribeBotLocale", - "lex:UpdateBotAlias", - "lex:CreateSlotType", - "lex:DeleteBotLocale", - "lex:DescribeBot", - "lex:UpdateBotLocale", - "lex:CreateSlot", - "lex:DeleteSlot", - "lex:UpdateBot", - "lex:DeleteSlotType", - "lex:DescribeBotAlias", - "lex:CreateBotLocale", - "lex:DeleteIntent", - "lex:StartImport", - "lex:UpdateSlotType", - "lex:UpdateIntent", - "lex:DescribeImport", - "lex:CreateCustomVocabulary", - "lex:UpdateCustomVocabulary", - "lex:DeleteCustomvocabulary", - "lex:DescribeCustomVocabulary", - "lex:DescribeCustomVocabularyMetadata" - ], - "Resource": [ - "arn:aws:lex:>Region<:>123456789012<:bot/*", - "arn:aws:lex:>Region<:>123456789012<:bot-alias/*/*" - ] - }, - { - "Sid": "showBots", - "Effect": "Allow", - "Action": [ - "lex:CreateUploadUrl", - "lex:ListBots" - ], - "Resource": "*" - } - ] - } - - @@ -606,24 +417,0 @@ The following IAM permission policy allows a user to draw the conversation flow -JSON -