AWS memorydb high security documentation change

Service: memorydb · 2025-08-28 · Security-related high

File: memorydb/latest/devguide/security-iam-awsmanpol.md

Summary

Removed JSON policy example containing EC2 network interface permissions and MemoryDB replication action

Security assessment

The removed policy included security-sensitive permissions like ec2:CreateNetworkInterface and memorydb:ReplicateMultiRegionClusterData. Removing these from documentation suggests potential tightening of recommended permissions, which impacts security posture.

Diff

diff --git a/memorydb/latest/devguide/security-iam-awsmanpol.md b/memorydb/latest/devguide/security-iam-awsmanpol.md
index a27e67ea4..12bcbeb84 100644
--- a//memorydb/latest/devguide/security-iam-awsmanpol.md
+++ b//memorydb/latest/devguide/security-iam-awsmanpol.md
@@ -28,100 +27,0 @@ JSON
-****
-    
-    
-    
-     {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                    "Sid": "CreateMemoryDBTagsOnNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:CreateTags"
-                    ],
-                    "Resource": "arn:aws:ec2:*:*:network-interface/*",
-                    "Condition": {
-                        "StringEquals": {
-                            "ec2:CreateAction": "CreateNetworkInterface"
-                        },
-                        "ForAllValues:StringEquals": {
-                            "aws:TagKeys": [
-                                "AmazonMemoryDBManaged"
-                            ]
-                        }
-                    }
-                },
-                {
-                    "Sid": "CreateNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:CreateNetworkInterface"
-                    ],
-                    "Resource": [
-                        "arn:aws:ec2:*:*:network-interface/*",
-                        "arn:aws:ec2:*:*:subnet/*",
-                        "arn:aws:ec2:*:*:security-group/*"
-                    ]
-                },
-                {
-                    "Sid": "DeleteMemoryDBTaggedNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:DeleteNetworkInterface",
-                        "ec2:ModifyNetworkInterfaceAttribute"
-                    ],
-                    "Resource": "arn:aws:ec2:*:*:network-interface/*",
-                    "Condition": {
-                        "StringEquals": {
-                            "ec2:ResourceTag/AmazonMemoryDBManaged": "true"
-                        }
-                    }
-                },
-                {
-                    "Sid": "DeleteNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:DeleteNetworkInterface",
-                        "ec2:ModifyNetworkInterfaceAttribute"
-                    ],
-                    "Resource": "arn:aws:ec2:*:*:security-group/*"
-                },
-                {
-                    "Sid": "DescribeEC2Resources",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:DescribeSecurityGroups",
-                        "ec2:DescribeNetworkInterfaces",
-                        "ec2:DescribeAvailabilityZones",
-                        "ec2:DescribeSubnets",
-                        "ec2:DescribeVpcs"
-                    ],
-                    "Resource": "*"
-                },
-                {
-                    "Sid": "PutCloudWatchMetricData",
-                    "Effect": "Allow",
-                    "Action": [
-                        "cloudwatch:PutMetricData"
-                    ],
-                    "Resource": "*",
-                    "Condition": {
-                        "StringEquals": {
-                            "cloudwatch:namespace": "AWS/MemoryDB"
-                        }
-                    }
-                },
-                {
-    	         "Sid": "ReplicateMemoryDBMultiRegionClusterData",
-    		   "Effect": "Allow",
-    		   "Action": [
-    				"memorydb:ReplicateMultiRegionClusterData"
-    		   ],
-                    "Resource": "arn:aws:memorydb:*:*:cluster/*"
-                }
-            ]
-        }
-    
-
-JSON
-    
-