AWS memorydb high security documentation change

Service: memorydb · 2025-08-28 · Security-related high

File: memorydb/latest/devguide/using-service-linked-roles.md

Summary

Removed JSON policy example for service-linked role permissions

Security assessment

The deleted policy defined critical IAM permissions for MemoryDB service-linked roles, including network interface management and cross-region data replication. Removal indicates security policy updates affecting privilege boundaries.

Diff

diff --git a/memorydb/latest/devguide/using-service-linked-roles.md b/memorydb/latest/devguide/using-service-linked-roles.md
index e6f95837b..f11d6913c 100644
--- a//memorydb/latest/devguide/using-service-linked-roles.md
+++ b//memorydb/latest/devguide/using-service-linked-roles.md
@@ -57,99 +56,0 @@ JSON
-****
-    
-    
-    
-    {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                    "Sid": "CreateMemoryDBTagsOnNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:CreateTags"
-                    ],
-                    "Resource": "arn:aws:ec2:*:*:network-interface/*",
-                    "Condition": {
-                        "StringEquals": {
-                            "ec2:CreateAction": "CreateNetworkInterface"
-                        },
-                        "ForAllValues:StringEquals": {
-                            "aws:TagKeys": [
-                                "AmazonMemoryDBManaged"
-                            ]
-                        }
-                    }
-                },
-                {   
-                    "Sid": "CreateNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:CreateNetworkInterface"
-                    ],
-                    "Resource": [
-                        "arn:aws:ec2:*:*:network-interface/*",
-                        "arn:aws:ec2:*:*:subnet/*",
-                        "arn:aws:ec2:*:*:security-group/*"
-                    ]
-                },
-                {
-                    "Sid": "DeleteMemoryDBTaggedNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:DeleteNetworkInterface",
-                        "ec2:ModifyNetworkInterfaceAttribute"
-                    ],
-                    "Resource": "arn:aws:ec2:*:*:network-interface/*",
-                    "Condition": {
-                        "StringEquals": {
-                            "ec2:ResourceTag/AmazonMemoryDBManaged": "true"
-                        }
-                    }
-                },
-                {
-                    "Sid": "DeleteNetworkInterfaces",
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:DeleteNetworkInterface",
-                        "ec2:ModifyNetworkInterfaceAttribute"
-                    ],
-                    "Resource": "arn:aws:ec2:*:*:security-group/*"
-                },
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "ec2:DescribeSecurityGroups",
-                        "ec2:DescribeNetworkInterfaces",
-                        "ec2:DescribeAvailabilityZones",
-                        "ec2:DescribeSubnets",
-                        "ec2:DescribeVpcs"
-                    ],
-                    "Resource": "*"
-                },
-                {
-                    "Sid": "PutCloudWatchMetricData",
-                    "Effect": "Allow",
-                    "Action": [
-                        "cloudwatch:PutMetricData"
-                    ],
-                    "Resource": "*",
-                    "Condition": {
-                        "StringEquals": {
-                            "cloudwatch:namespace": "AWS/MemoryDB"
-                        }
-                    }
-                },
-    	      {
-    	          "Sid": "ReplicateMemoryDBMultiRegionClusterData",
-    		    "Effect": "Allow",
-    		    "Action": [
-    			      "memorydb:ReplicateMultiRegionClusterData"
-    		    ],
-    		    "Resource": "arn:aws:memorydb:*:*:cluster/*"
-     		}
-              ]
-        }
-    
-
-JSON
-    
-