AWS opensearch-service documentation change
Summary
Removed multiple JSON policy examples related to Kinesis stream access permissions, encryption policies, and trust relationships
Security assessment
The changes remove example IAM policies but do not indicate a security vulnerability fix. These were likely documentation examples for proper configuration rather than addressing a specific security flaw.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-kinesis.md b/opensearch-service/latest/developerguide/configure-client-kinesis.md index 1d2c3133f..6fc22da71 100644 --- a//opensearch-service/latest/developerguide/configure-client-kinesis.md +++ b//opensearch-service/latest/developerguide/configure-client-kinesis.md @@ -40,33 +39,0 @@ To create an IAM role with the correct permissions to access write data to the c -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "allowReadFromStream", - "Effect": "Allow", - "Action": [ - "kinesis:DescribeStream", - "kinesis:DescribeStreamConsumer", - "kinesis:DescribeStreamSummary", - "kinesis:GetRecords", - "kinesis:GetShardIterator", - "kinesis:ListShards", - "kinesis:ListStreams", - "kinesis:ListStreamConsumers", - "kinesis:RegisterStreamConsumer", - "kinesis:SubscribeToShard" - ], - "Resource": [ - "arn:aws:kinesis:AWS Region:account-id:stream/stream-name" - ] - } - ] - } - - - @@ -75,23 +41,0 @@ If server-side encryption is enabled on the streams, the following AWS KMS polic -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "allowDecryptionOfCustomManagedKey", - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "arn:aws:kinesis:AWS Region:account-id:key/key-id" - } - ] - } - - - @@ -233,40 +176,0 @@ Replace the `placeholder values` with your own information. -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "StreamReadStatementID", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::osi-pipeline-account-ID:role/Pipeline-Role" - }, - "Action": [ - "kinesis:DescribeStreamSummary", - "kinesis:GetRecords", - "kinesis:GetShardIterator", - "kinesis:ListShards" - ], - "Resource": "arn:aws:kinesis:AWS Region:stream-account-id:stream/stream-name" - }, - { - "Sid": "StreamEFOReadStatementID", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::osi-pipeline-account-ID:role/Pipeline-Role" - }, - "Action": [ - "kinesis:DescribeStreamSummary", - "kinesis:ListShards" - ], - "Resource": "Consumer ARN" - } - ] - } - - - @@ -294,26 +197,0 @@ In the following statement, replace the `placeholder values` with your own infor -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "ConsumerEFOReadStatementID", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::osi-pipeline-account-ID:role/Pipeline-Role" - }, - "Action": [ - "kinesis:DescribeStreamConsumer", - "kinesis:SubscribeToShard" - ], - "Resource": "arn:aws::kinesis:AWS Region:customer-kinesis-stream-account-ID:stream/stream-1/consumer-name:<>" - } - ] - } - - - @@ -399,42 +276,0 @@ Add the following policy to the pipeline role. Replace the `placeholder values` -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "kinesis:DescribeStreamConsumer", - "kinesis:SubscribeToShard" - ], - "Resource": [ - "consumer ARN", - "consumer ARN:*" - ] - }, - { - "Sid": "allowReadFromStream", - "Effect": "Allow", - "Action": [ - "kinesis:DescribeStream", - "kinesis:DescribeStreamSummary", - "kinesis:GetRecords", - "kinesis:GetShardIterator", - "kinesis:ListShards", - "kinesis:ListStreams", - "kinesis:ListStreamConsumers", - "kinesis:RegisterStreamConsumer" - ], - "Resource": [ - "stream ARN" - ] - } - ] - } - - - @@ -445,19 +280,0 @@ In order to ingest data from the stream account, you will need to establish a tr -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [{ - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::stream-account-id:root" - }, - "Action": "sts:AssumeRole" - }] - } - - -