AWS mgn documentation change
Summary
Simplified CloudFormation template instructions by replacing placeholder values and restructuring JSON policy examples. Updated account number placeholder from ACCOUNT-ID to 111122223333 and added explicit region replacement guidance.
Security assessment
The changes clarify IAM role configuration but do not address security vulnerabilities. While IAM policies are security-related, this is a documentation improvement rather than a response to a specific security issue.
Diff
diff --git a/mgn/latest/ug/CloudFormation_Template.md b/mgn/latest/ug/CloudFormation_Template.md index 34926b149..86c4c8687 100644 --- a//mgn/latest/ug/CloudFormation_Template.md +++ b//mgn/latest/ug/CloudFormation_Template.md @@ -11,137 +11 @@ Alternatively, see the [previous section](./create-permissions-manually.html) to - 1. Replace **ACCOUNT-ID** with your account number. - - 2. Replace **ROLE-NAME** with the user role that serves as the trusted entity to assume **MGNConnectorInstallerRole** role and install the connector. - - 3. Replace **AWS_REGION** with the connector region. - - 4. Replace **LOGS-BUCKET** with S3 logs bucket name. Remove the relevant item from the statement if you have not set up outputting logs to S3. - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Resources": { - "MGNConnectorInstallerRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::ACCOUNT-ID:ROLE-NAME" - }, - "Action": "sts:AssumeRole" - }re - ] - }, - "Policies": [ - { - "PolicyName": "MGNConnectorInstallerPolicy", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "mgn:TagResource", - "Resource": "arn:aws:mgn:*:*:connector/*", - "Condition": { - "StringEquals": { - "mgn:CreateAction": "CreateConnector" - } - } - }, - { - "Effect": "Allow", - "Action": "mgn:CreateConnector", - "Resource": "*" - } - ] - } - } - ] - } - }, - "AWSApplicationMigrationConnectorManagementRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ssm.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - }, - "ManagedPolicyArns": [ - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" - ], - "Policies": [ - { - "PolicyName": "MgnConnectorPolicy", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "logs:CreateLogGroup", - "logs:CreateLogStream", - "logs:DescribeLogGroups", - "logs:DescribeLogStreams", - "logs:PutLogEvents" - ], - "Resource": "*" - }, - { - "Action": [ - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::aws-application-migration-service-us-east-2/latest/source-automation-client/linux/ssaf-client/ssaf_client", - "arn:aws:s3:::us-east-2/*" - ], - "Effect": "Allow" - }, - { - "Action": [ - "s3:PutObject" - ], - "Resource": "arn:aws:s3:::LOGS-BUCKET/*", - "Effect": "Allow" - }, - { - "Effect": "Allow", - "Action": "sts:AssumeRole", - "Resource": "arn:aws:iam::*:role/AWSApplicationMigrationConnectorSharingRole_111122223333" - }, - { - "Effect": "Allow", - "Action": "secretsmanager:GetSecretValue", - "Resource": "arn:aws:secretsmanager:*:*:secret:*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" - } - } - } - ] - } - } - ] - } - } - }, - ] - } + 1. Replace the example account number **111122223333** with your account number. @@ -148,0 +13,5 @@ JSON + 2. Replace **ROLE-NAME** with the user role that serves as the trusted entity. This user role assumes the **MGNConnectorInstallerRole** role and can install the connector. + + 3. Replace the example region **us-east-2** with the Region of the account. + + 4. Replace **LOGS-BUCKET** with the S3 logs bucket name. Remove the relevant item from the statement if you have not set up outputting logs to S3.