AWS iot-sitewise medium security documentation change
Summary
Updated S3 bucket policy examples: Changed SID values, removed explicit 'Principal' declarations, and replaced placeholder bucket ARNs with specific examples
Security assessment
Removal of 'Principal' declarations in bucket policies could lead to overly permissive access if followed literally, as policies without principal restrictions apply to all principals. The change from placeholder ARNs to specific examples reduces misconfiguration risks but introduces hardcoded values that might be copied without modification.
Diff
diff --git a/iot-sitewise/latest/userguide/anomaly-prerequisites.md b/iot-sitewise/latest/userguide/anomaly-prerequisites.md index 54a7c0919..be968729d 100644 --- a//iot-sitewise/latest/userguide/anomaly-prerequisites.md +++ b//iot-sitewise/latest/userguide/anomaly-prerequisites.md @@ -45 +45,7 @@ To set up anomaly detection, you must have the following requirements and the [U -On console, go to **Permissions - > Bucket policy**. Paste the following policy and replace **bucket-arn** with ARN of your bucket. +On console, go to **Permissions - > Bucket policy**. Replace the bucket ARN with ARN of your bucket. + +JSON + + +**** + @@ -51 +57 @@ On console, go to **Permissions - > Bucket policy**. Paste the following policy - "Sid": "SiteWiseReadAccess", + "Sid": "SiteWiseS3ReadAccess", @@ -53,3 +58,0 @@ On console, go to **Permissions - > Bucket policy**. Paste the following policy - "Principal": { - "Service": "iotsitewise.amazonaws.com" - }, @@ -61,2 +64,2 @@ On console, go to **Permissions - > Bucket policy**. Paste the following policy - "bucket-arn", - "bucket-arn/*" + "arn:aws:s3:::amzn-s3-demo-bucketbucket-name", + "arn:aws:s3:::amzn-s3-demo-bucketbucket-name/*" @@ -77 +81,7 @@ On console, go to **Permissions - > Bucket policy**. Paste the following policy -On console, go to `Permissions -> Bucket policy`. Paste the following policy and replace: `bucket-arn` with ARN of your bucket +On console, go to `Permissions -> Bucket policy`. Replace the bucket ARN with ARN of your bucket. + +JSON + + +**** + @@ -83 +93 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and - "Sid": "SiteWiseWriteAccess", + "Sid": "SiteWiseS3Access", @@ -85,3 +94,0 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and - "Principal": { - "Service": "iotsitewise.amazonaws.com" - }, @@ -94,2 +101,2 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and - "bucket-arn", - "bucket-arn/*" + "arn:aws:s3:::amzn-s3-demo-bucket", + "arn:aws:s3:::amzn-s3-demo-bucket/*" @@ -110 +118,7 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and -On console, go to `Permissions -> Bucket policy`. Paste the following policy and replace: `bucket-arn` with ARN of your bucket +On console, go to `Permissions -> Bucket policy`. Replace the bucket ARN with ARN of your bucket. + +JSON + + +**** + @@ -116 +130 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and - "Sid": "SiteWiseWriteAccess", + "Sid": "SiteWiseS3Access", @@ -118,3 +131,0 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and - "Principal": { - "Service": "iotsitewise.amazonaws.com" - }, @@ -127,2 +138,2 @@ On console, go to `Permissions -> Bucket policy`. Paste the following policy and - "bucket-arn", - "bucket-arn/*" + "arn:aws:s3:::amzn-s3-demo-bucket", + "arn:aws:s3:::amzn-s3-demo-bucket-s3-bucket;/*"