AWS managedservices high security documentation change
Summary
Enhanced IAM policy standard 4.20 with violation handling details and removed role cloning section
Security assessment
Strengthens S3 access controls by differentiating enforcement between account types and removing risky role cloning guidance
Diff
diff --git a/managedservices/latest/userguide/ams-sec-stand-controls.md b/managedservices/latest/userguide/ams-sec-stand-controls.md index d639c9cf8..cf8959d00 100644 --- a//managedservices/latest/userguide/ams-sec-stand-controls.md +++ b//managedservices/latest/userguide/ams-sec-stand-controls.md @@ -149 +149,6 @@ ID | Technical standard -4.20 | IAM policies must not allow reading of objects (for example, S3:GetObject) in all the S3 buckets in the account. +4.20 | IAM policies must not allow unrestricted read access to Amazon S3 bucket objects (for example, Amazon S3:GetObject) across all buckets in an account: + + * In Developer mode accounts: Violations result in a Risk Notification + * In non-Developer mode accounts: Violations require Risk Acceptance + + @@ -181 +185,0 @@ ID | Technical standard -9.2 | Developer mode, DCM role or AMS provided high privileged roles cloning or assignment of policy set from these roles to an existing role will result in risk notification. In general, cloning AMS Role/Policy and modifying them as needed is permitted, inline with the IAM technical standards.