AWS AmazonCloudWatch documentation change
Summary
Added requirement for AmazonRDSPerformanceInsightsFullAccess policy and Database Insights integration
Security assessment
Documents expanded IAM permissions required for investigations features. While related to access control, there's no evidence of addressing a security vulnerability. The added permissions could impact security if misconfigured.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/Investigations-GetStarted.md b/AmazonCloudWatch/latest/monitoring/Investigations-GetStarted.md index 635dfe211..17950be8d 100644 --- a//AmazonCloudWatch/latest/monitoring/Investigations-GetStarted.md +++ b//AmazonCloudWatch/latest/monitoring/Investigations-GetStarted.md @@ -80 +80 @@ To be able to choose either of the first two options, you must be signed in to a - * The recommended option is to choose **Auto-create a new role with default investigation permissions**. If you choose this option, the assistant is granted the **AIOpsAssistantPolicy** IAM policy. For more information about the contents of this policy, see [IAM policy for CloudWatch investigations (AIOpsAssistantPolicy)](./auth-and-access-control-cw.html#managed-policies-QInvestigations-AIOpsAssistant). + * The recommended option is to choose **Auto-create a new role with default investigation permissions**. If you choose this option, the assistant is granted both the **AIOpsAssistantPolicy** and the **AmazonRDSPerformanceInsightsFullAccess** IAM policies. For more information about the contents of these policies, see [AIOpsAssistantPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AIOpsAssistantPolicy.html) and [AmazonRDSPerformanceInsightsFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRDSPerformanceInsightsFullAccess.html) in the _AWS Managed Policy Reference Guide_. @@ -86 +86 @@ To be able to choose either of the first two options, you must be signed in to a -If you choose this option, you must make sure the role includes a trust policy that names `aiops.amazonaws.com` as the service principal. For more information about using service principals in trust policies, see [AWS service principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) +If you choose this option, you must make sure the role includes a trust policy that names `aiops.amazonaws.com` as the service principal. For more information about using service principals in trust policies, see [AWS service principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services). @@ -140,0 +141,2 @@ For more information about how these services help CloudWatch investigations, se + 4. If you use Amazon RDS, enable the Advanced mode of Database Insights on your database instances. Database Insights monitors database load and provides detailed performance analysis that helps CloudWatch investigations identify database-related issues during investigations. When Advanced Database Insights is enabled, CloudWatch investigations can automatically generate performance analysis reports that include detailed observations, metric anomalies, root cause analysis, and recommendations specific to your database workload. For more information about Database Insights and how to enable Advanced mode, see [Monitoring Amazon RDS databases with CloudWatch Database Insights](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DatabaseInsights.html) +