AWS systems-manager-automation-runbooks medium security documentation change
Summary
Removed detailed IAM policy example for Kubernetes API proxy setup including tag-based access controls and Lambda/CloudFormation permissions
Security assessment
Elimination of granular permission examples for EKS proxy configuration removes security-focused guidance around role tagging and service-specific access. This could result in improper IAM policies for sensitive Kubernetes API access
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupk8sapiproxyforeks.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupk8sapiproxyforeks.md index a36009ae1..d9afc1165 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupk8sapiproxyforeks.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupk8sapiproxyforeks.md @@ -195,158 +194,0 @@ Below is an example policy demonstrating permissions required for ` AutomationAs -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "tag:GetResources", - "tag:TagResources", - "ec2:CreateNetworkInterface", - "ec2:DescribeNetworkInterfaces", - "ec2:DescribeRouteTables", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSubnets", - "ec2:DescribeVpcs", - "ec2:DeleteNetworkInterface", - "eks:DescribeCluster", - "iam:GetRole", - "cloudformation:DescribeStacks", - "logs:DescribeLogGroups", - "logs:DescribeLogStreams", - "lambda:GetFunction", - "lambda:ListTags", - "logs:ListTagsForResource" - ], - "Resource": "*", - "Effect": "Allow", - "Sid": "AllowActionsWithoutConditions" - }, - { - "Condition": { - "StringEquals": { - "aws:RequestTag/AWSSupport-SetupK8sApiProxyForEKS": "true" - } - }, - "Action": "iam:CreateRole", - "Resource": [ - "arn:aws::iam::111122223333:role/Automation-K8sProxy*" - ], - "Effect": "Allow", - "Sid": "AllowCreateRoleWithRequiredTag" - }, - { - "Condition": { - "StringEquals": { - "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true" - } - }, - "Action": [ - "iam:DeleteRole", - "iam:TagRole", - "iam:UntagRole" - ], - "Resource": [ - "arn:aws::iam::111122223333:role/Automation-K8sProxy*" - ], - "Effect": "Allow", - "Sid": "IAMActions" - }, - { - "Condition": { - "StringEquals": { - "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true" - }, - "StringLike": { - "iam:PolicyARN": [ - "arn:<partition>:iam::<partition>:policy/service-role/AWSLambdaBasicExecutionRole", - "arn:<partition>:iam::<partition>:policy/service-role/AWSLambdaVPCAccessExecutionRole" - ] - } - }, - "Action": [ - "iam:AttachRolePolicy", - "iam:DetachRolePolicy" - ], - "Resource": [ - "arn:aws::iam::111122223333:role/Automation-K8sProxy*" - ], - "Effect": "Allow", - "Sid": "AttachRolePolicy" - }, - { - "Condition": { - "StringEquals": { - "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true" - } - }, - "Action": [ - "lambda:CreateFunction", - "lambda:DeleteFunction", - "lambda:TagResource", - "lambda:UntagResource", - "lambda:UpdateFunctionCode" - ], - "Resource": "arn:aws::lambda:us-east-1:111122223333:function:Automation-K8sProxy*", - "Effect": "Allow", - "Sid": "LambdaActions" - }, - { - "Condition": { - "StringEquals": { - "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true" - } - }, - "Action": [ - "cloudformation:CreateStack", - "cloudformation:DeleteStack", - "cloudformation:UpdateStack" - ], - "Resource": "arn:aws::cloudformation:us-east-1:111122223333:stack/AWSSupport-SetupK8sApiProxyForEKS*", - "Effect": "Allow", - "Sid": "CloudFormationActions" - }, - { - "Condition": { - "StringEquals": { - "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true" - } - }, - "Action": [ - "logs:CreateLogGroup", - "logs:CreateLogStream", - "logs:PutLogEvents", - "logs:PutRetentionPolicy", - "logs:TagResource", - "logs:UntagResource" - ], - "Resource": [ - "arn:aws::logs:us-east-1:111122223333:log-group:/aws/lambda/Automation-K8sProxy*", - "arn:aws::logs:us-east-1:111122223333:log-group:/aws/lambda/Automation-K8sProxy*:*" - ], - "Effect": "Allow", - "Sid": "LogsActions" - }, - { - "Condition": { - "StringLikeIfExists": { - "iam:PassedToService": "lambda.amazonaws.com" - } - }, - "Action": [ - "iam:PassRole" - ], - "Resource": [ - "arn:aws::iam::111122223333:role/Automation-K8sProxy-Role*" - ], - "Effect": "Allow", - "Sid": "PassRoleToLambda" - } - ] - } - -