AWS prometheus medium security documentation change
Summary
Added guidance for SNS topic configuration in opt-in regions with regional service principals
Security assessment
The change addresses secure cross-region alert delivery by specifying proper service principal formats, preventing potential misconfigurations that could lead to unauthorized access or alert delivery failures in opt-in regions.
Diff
diff --git a/prometheus/latest/userguide/AMP-alertmanager-receiver-AMPpermission.md b/prometheus/latest/userguide/AMP-alertmanager-receiver-AMPpermission.md index c8b6b28d9..c49e9fbf5 100644 --- a//prometheus/latest/userguide/AMP-alertmanager-receiver-AMPpermission.md +++ b//prometheus/latest/userguide/AMP-alertmanager-receiver-AMPpermission.md @@ -5 +5 @@ -Cross-service confused deputy prevention +SNS topic configuration for opt-in regionsCross-service confused deputy prevention @@ -76,0 +77,20 @@ IAM follows the [ Most-restrictive policy first ](https://docs.aws.amazon.com/IA +## SNS topic configuration for opt-in regions + +You can use `aps.amazonaws.com` to configure an Amazon SNS topic in the same AWS Region as your Amazon Managed Service for Prometheus workspace. To use an SNS topic from a non-opt-in Region (such as us-east-1) with an opt-in Region (such as af-south-1), you need to use the Regional service principal format. In the Regional service principle, replace `us-east-1` with the non-opt-in Region you want to use: `aps.`us-east-1`.amazonaws.com`. + +The following table lists the opt-in Regions and their corresponding Regional service principals: + +Opt-in Regions and their Regional service principals Region name | Region | Regional service principal +---|---|--- +Africa (Cape Town) | af-south-1 | af-south-1.aps.amazonaws.com +Asia Pacific (Hong Kong) | ap-east-1 | ap-east-1.aps.amazonaws.com +Asia Pacific (Thailand) | ap-southeast-7 | ap-southeast-7.aps.amazonaws.com +Europe (Milan) | eu-south-1 | eu-south-1.aps.amazonaws.com +Europe (Zurich) | eu-central-2 | eu-central-2.aps.amazonaws.com +Middle East (UAE) | me-central-1 | me-central-1.aps.amazonaws.com +Asia Pacific (Malaysia) | ap-southeast-5 | ap-southeast-5.aps.amazonaws.com + +For information on enabling an opt-in Region, see [Managing AWS Regions](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html) in the _IAM User Guide_ in the Amazon Web Services General Reference. + +When configuring your Amazon SNS topic for these opt-in Regions, ensure you use the correct Regional service principal to enable cross-region delivery of alerts. +