AWS snowball medium security documentation change

Service: snowball · 2025-08-28 · Security-related medium

File: snowball/latest/developer-guide/access-control-managing-permissions.md

Summary

Removed comprehensive IAM policy example for Snowball device management permissions including S3, Lambda, and IAM operations

Security assessment

Eliminated detailed policy showing required permissions for Snowball operations including sensitive IAM role management and S3 bucket access controls. This could impact users' ability to implement least-privilege access for data transfer operations.

Diff

diff --git a/snowball/latest/developer-guide/access-control-managing-permissions.md b/snowball/latest/developer-guide/access-control-managing-permissions.md
index 266fa8f9f..fb614986c 100644
--- a//snowball/latest/developer-guide/access-control-managing-permissions.md
+++ b//snowball/latest/developer-guide/access-control-managing-permissions.md
@@ -193,117 +192,0 @@ JSON
-                ],
-                "Resource": [
-                    "*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "snowball:*"
-                ],
-                "Resource": [
-                    "*"
-                ]
-            }
-        ]
-    }
-    
-
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "s3:GetBucketLocation",
-                    "s3:GetBucketPolicy",
-                    "s3:ListBucket",
-                    "s3:ListBucketMultipartUploads",
-                    "s3:ListAllMyBuckets"
-                ],
-                "Resource": "arn:aws:s3:::*"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "s3:CreateBucket",
-                    "s3:PutObject",
-                    "s3:AbortMultipartUpload",
-                    "s3:ListMultipartUploadParts",
-                    "s3:PutObjectAcl"
-                ],
-                "Resource": "arn:aws:s3:::*"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "lambda:GetFunction",
-                    "lambda:GetFunctionConfiguration"
-                ],
-                "Resource": "arn:aws:lambda:aws-region:*:function:*"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "lambda:ListFunctions"
-                ],
-                "Resource": "arn:aws:lambda:aws-region:*:*"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "iam:AttachRolePolicy",
-                    "iam:CreatePolicy",
-                    "iam:CreateRole",
-                    "iam:ListRoles",
-                    "iam:ListRolePolicies",
-                    "iam:PutRolePolicy"
-                ],
-                "Resource": [
-                    "*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": "iam:PassRole",
-                "Resource": "arn:aws:iam::*:role/snowball*",
-                "Condition": {
-                    "StringEquals": {
-                        "iam:PassedToService": "importexport.amazonaws.com"
-                    }
-                }
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:DescribeImages",
-                    "ec2:ModifyImageAttribute"
-                ],
-                "Resource": [
-                    "*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "sns:CreateTopic",
-                    "sns:ListTopics",
-                    "sns:GetTopicAttributes",
-                    "sns:SetTopicAttributes",
-                    "sns:ListSubscriptionsByTopic",
-                    "sns:Subscribe"
-                ],
-                "Resource": [
-                    "*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "greengrass:getServiceRoleForAccount"