AWS directoryservice medium security documentation change

Service: directoryservice · 2025-09-19 · Security-related medium

File: directoryservice/latest/admin-guide/iam_dsdata-condition-keys.md

Summary

Added detailed JSON policy examples for IAM conditions, modified existing policy examples to refine actions/conditions (e.g., changed UpdateGroup to AddGroupMember, added Deny policy for ListUsers in specific realm)

Security assessment

The change introduces a Deny policy example restricting ListUsers in a specific realm (one.tru1.amazon.com), which directly addresses potential information disclosure risks. Modifying actions from UpdateGroup to AddGroupMember and adding explicit deny conditions improves least-privilege guidance.

Diff

diff --git a/directoryservice/latest/admin-guide/iam_dsdata-condition-keys.md b/directoryservice/latest/admin-guide/iam_dsdata-condition-keys.md
index fe53234cb..71c1048d0 100644
--- a//directoryservice/latest/admin-guide/iam_dsdata-condition-keys.md
+++ b//directoryservice/latest/admin-guide/iam_dsdata-condition-keys.md
@@ -32,0 +33,31 @@ The following policy denies the IAM principal from describing the user `joe` or
+JSON
+    
+
+****
+    
+    
+    
+    {
+      "Version": "2012-10-17",		 	 	 
+      "Statement": [
+        {
+          "Sid": "DenyDescribe",
+          "Effect": "Deny",
+          "Action": "ds-data:Describe*",
+          "Resource": "*",
+          "Condition": {
+            "StringEqualsIgnoreCase": {
+              "ds-data:SAMAccountName": [
+                "joe",
+                "joegroup"
+              ],
+              "ds-data:identifier": [
+                "SAMAccountName"
+              ]
+            }
+          }
+        }
+      ]
+    }
+    
+
@@ -44,0 +76,30 @@ The following policy allows the IAM principal to update the user `joe`.
+JSON
+    
+
+****
+    
+    
+    
+    {
+      "Version": "2012-10-17",		 	 	 
+      "Statement": [
+        {
+          "Sid": "UpdateJoe",
+          "Effect": "Allow",
+          "Action": "ds-data:UpdateUser",
+          "Resource": "arn:aws:ds:us-east-1:111122223333:directory/d-012345678",
+          "Condition": {
+            "StringEqualsIgnoreCase": {
+              "ds-data:SAMAccountName": [
+                "joe"
+              ],
+              "ds-data:identifier": [
+                "SAMAccountName"
+              ]
+            }
+          }
+        }
+      ]
+    }
+    
+
@@ -68 +129 @@ JSON
-          "Sid": "UpdateGroupsWithRegionalMembers",
+            "Sid": "AddJoe",
@@ -70 +131 @@ JSON
-          "Action": "ds-data:UpdateGroup",
+            "Action": "ds-data:AddGroupMember",
@@ -74,3 +135 @@ JSON
-              "ds-data:MemberName": [
-                "region-1-*"
-              ]
+                    "ds-data:MemberName": "joe"
@@ -115 +174 @@ JSON
-          "Sid": "UpdateMembersInRealm",
+          "Sid": "addbob",
@@ -117 +176 @@ JSON
-          "Action": "ds-data:UpdateGroup",
+          "Action": "ds-data:AddGroupMember",
@@ -121,3 +180,2 @@ JSON
-              "ds-data:MemberRealm": [
-                "region-1-*"
-              ]
+              "ds-data:MemberName": "bob",
+              "ds-data:MemberRealm": "one.tru1.amazon.com"
@@ -154,3 +212,3 @@ JSON
-          "Sid": "UpdateGroupsInRealm",
-          "Effect": "Allow",
-          "Action": "ds-data:CreateGroup",
+          "Sid": "DenyTrustedList",
+          "Effect": "Deny",
+          "Action": "ds-data:ListUsers",
@@ -161 +219 @@ JSON
-                "example-domain.com"
+                "one.tru1.amazon.com"