AWS textract documentation change
Summary
Removed multiple IAM policy examples related to Textract adapters, inference APIs, KMS permissions, and resource tagging
Security assessment
The removal of these security policy examples may reduce guidance for secure configurations. However, there's no concrete evidence that these examples were addressing specific security vulnerabilities or weaknesses. The change could impact users' ability to implement least privilege policies but isn't tied to a disclosed security issue.
Diff
diff --git a/textract/latest/dg/security_iam_id-based-policy-examples.md b/textract/latest/dg/security_iam_id-based-policy-examples.md index ea1e8a1b4..b06490de2 100644 --- a//textract/latest/dg/security_iam_id-based-policy-examples.md +++ b//textract/latest/dg/security_iam_id-based-policy-examples.md @@ -139,25 +138,0 @@ Although you can use `*` to access all resources in inference operations, you ca -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "OnlyAllowAccessVersionsOneAdapter", - "Effect": "Allow", - "Action": [ - "textract:AnalyzeDocument", - "textract:StartDocumentAnalysis" - ], - "Resource": [ - "arn:aws:textract:<us-east-1>:<123456789012>:/adapters/<adapter-id>/versions/*" - ] - } - ] - } - - @@ -166,36 +140,0 @@ JSON -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowUsingTextractInferenceAPI", - "Effect": "Allow", - "Action": [ - "textract:AnalyzeDocument", - "textract:StartDocumentAnalysis" - ], - "Resource": [ - "*" - ] - }, - { - "Sid": "DenyUsingAdaptersForInferenceAPI", - "Effect": "Deny", - "Action": [ - "textract:AnalyzeDocument", - "textract:StartDocumentAnalysis" - ], - "Resource": [ - "arn:aws:textract:<us-east-1>:<123456789012:/adapters/*" - ] - } - ] - } - - @@ -206,41 +144,0 @@ Tag the specific adapters that you want to control by using the `TagResource` op -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowUsingTextractInferenceAPI", - "Effect": "Allow", - "Action": [ - "textract:AnalyzeDocument", - "textract:StartDocumentAnalysis" - ], - "Resource": [ - "*" - ] - }, - { - "Sid": "DenyAdaptersWithoutSpecificTags", - "Effect": "Deny", - "Action": [ - "textract:AnalyzeDocument", - "textract:StartDocumentAnalysis" - ], - "Resource": [ - "arn:aws:textract:<us-east-1>:<123456789012>:/adapters/*" - ], - "Condition": { - "StringNotEquals": { - "aws:ResourceTag/env": "prod" - } - } - } - ] - } - - @@ -249,41 +146,0 @@ JSON -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowManagingAdapterAndVersions", - "Effect": "Allow", - "Action": [ - "textract:GetAdapter", - "textract:DeleteAdapter", - "textract:UpdateAdapter", - "textract:GetAdapterVersion", - "textract:DeleteAdapterVersion" - ], - "Resource": [ - "arn:aws:textract:<us-east-1>:<account-id>:/adapters/<adapter-id>/versions/*" - ] - }, - { - "Sid": "AllowCreatingAndListingAdpaterAndVersions", - "Effect": "Allow", - "Action": [ - "textract:CreateAdapter", - "textract:CreateAdapterVersion", - "textract:ListAdapters", - "textract:ListAdapterVersions" - ], - "Resource": [ - "*" - ] - } - ] - } - - @@ -294,61 +150,0 @@ In addition to `"textract:CreateAdapterVersion"` permission, the caller identity -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowCreatingAdapterVersions", - "Effect": "Allow", - "Action": [ - "textract:CreateAdapterVersion" - ], - "Resource": [ - "arn:aws:textract:<us-east-1>:<123456789012>:/adapters/<adapter-id>" - ] - }, - { - "Sid": "AllowAccessingDataset", - "Effect": "Allow", - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": [ - "arn:aws:s3:::datasetBucketName/*" - ] - }, - { - "Sid": "AllowAccessingOutputBucket", - "Effect": "Allow", - "Action": [ - "s3:PutObject", - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": [ - "arn:aws:s3:::outputConfigBucketName/*" - ] - }, - { - "Sid": "AllowUsingKmsKey", - "Effect": "Allow", - "Action": [ - "kms:Decrypt",