AWS transfer high security documentation change

Service: transfer · 2025-08-28 · Security-related high

File: transfer/latest/userguide/confused-deputy.md

Summary

Removed JSON examples of IAM role trust policies with source account/ARN conditions

Security assessment

The removed policies demonstrated protection against confused deputy attacks using AWS Condition keys. Removing these examples could indicate they contained insecure patterns or needed updating to prevent privilege escalation risks.

Diff

diff --git a/transfer/latest/userguide/confused-deputy.md b/transfer/latest/userguide/confused-deputy.md
index a7d8962d5..5a9dd61aa 100644
--- a//transfer/latest/userguide/confused-deputy.md
+++ b//transfer/latest/userguide/confused-deputy.md
@@ -76,30 +75,0 @@ The following example policy allows any user of a specific server to assume the
-JSON
-    
-
-****
-    
-    
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "",
-          "Effect": "Allow",
-          "Principal": {
-            "Service": "transfer.amazonaws.com"
-          },
-          "Action": "sts:AssumeRole",
-          "Condition": {
-            "StringEquals": {
-              "aws:SourceAccount": "account-id"
-            },
-            "ArnEquals": {
-              "aws:SourceArn": "arn:aws:transfer:us-east-1:account-id:user/server-id/*"
-            }
-          }
-        }
-      ]
-    }
-    
-
@@ -108,27 +77,0 @@ The following example policy allows a specific user of a specific server to assu
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "",
-                "Effect": "Allow",
-                "Principal": {
-                    "Service": "transfer.amazonaws.com"
-                },
-                "Action": "sts:AssumeRole",
-                "Condition": {
-                    "ArnLike": {
-                        "aws:SourceArn": "arn:aws:transfer:us-east-1:account-id:user/server-id/user-name"
-                    }
-                }
-            }
-        ]
-    }
-    
-