AWS opsworks documentation change

Service: opsworks · 2025-08-28 · Documentation medium

File: opsworks/latest/userguide/opsworks-security-users-examples.md

Summary

Removed multiple JSON examples of IAM policies with deny rules and permission configurations

Security assessment

The removed examples showed permission configurations but there's no evidence of addressing an active security issue. This appears to be content reorganization rather than security-related changes.

Diff

diff --git a/opsworks/latest/userguide/opsworks-security-users-examples.md b/opsworks/latest/userguide/opsworks-security-users-examples.md
index 23455ffa5..efa38c257 100644
--- a//opsworks/latest/userguide/opsworks-security-users-examples.md
+++ b//opsworks/latest/userguide/opsworks-security-users-examples.md
@@ -47,22 +46,0 @@ You can restrict the **Manage** permissions level to allow a user perform all **
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Deny",
-                "Action": [
-                    "opsworks:CreateLayer",
-                    "opsworks:DeleteLayer"
-                ],
-                "Resource": "arn:aws:opsworks:us-east-1:account_id:stack/stack_id/"
-            }
-        ]
-    }
-    
-
@@ -74,39 +51,0 @@ The **Manage** permissions level doesn't allow users to create or clone stacks.
-JSON
-    
-
-****
-    
-    
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": [
-            "iam:GetRolePolicy",
-            "iam:ListRoles",
-            "iam:ListInstanceProfiles",
-            "iam:ListUsers",
-            "opsworks:DescribeUserProfiles",
-            "opsworks:CreateUserProfile",
-            "opsworks:DeleteUserProfile"
-          ],
-          "Resource": "*"
-        },
-        {
-          "Effect": "Allow",
-          "Action": [
-            "iam:PassRole"
-          ],
-          "Resource": "arn:aws:opsworks::account_id:stack/*/",
-          "Condition": {
-            "StringEquals": {
-              "iam:PassedToService": "opsworks.amazonaws.com"
-            }
-          }
-        }
-      ]
-    }
-    
-
@@ -145,33 +83,0 @@ The **Manage** permissions level doesn't allow users to import users into OpsWor
-JSON
-    
-
-****
-    
-    
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": [
-            "iam:GetRolePolicy",
-            "iam:ListRoles",
-            "iam:ListInstanceProfiles",
-            "iam:ListUsers",
-            "iam:PassRole",
-            "opsworks:DescribeUserProfiles",
-            "opsworks:CreateUserProfile",
-            "opsworks:DeleteUserProfile"
-          ],
-          "Resource": "arn:aws:iam:region:account_id:user/*",
-          "Condition": {
-            "StringEquals": {
-              "iam:PassedToService": "opsworks.amazonaws.com"
-            }
-          }
-        }
-      ]
-    }
-    
-
@@ -182,22 +87,0 @@ The **Deploy** permissions level doesn't allow users to create or delete apps. Y
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "opsworks:CreateApp",
-                    "opsworks:DeleteApp"
-                ],
-                "Resource": "arn:aws:opsworks:us-east-1:account_id:stack/stack_id/"
-            }
-        ]
-    }
-    
-