AWS res medium security documentation change
Summary
Updated IAM role configuration instructions with detailed policy creation steps, added Windows 10/11 support, and included image references
Security assessment
The change adds explicit guidance for creating a custom IAM policy with limited DynamoDB/S3 access and proper trust relationships. This enforces least-privilege security principles. The detailed policy configuration steps help prevent misconfiguration risks.
Diff
diff --git a/res/archive/release-minus-2/ug/res-ready-ami.md b/res/archive/release-minus-2/ug/res-ready-ami.md index bb22692ab..fa48a0f98 100644 --- a//res/archive/release-minus-2/ug/res-ready-ami.md +++ b//res/archive/release-minus-2/ug/res-ready-ami.md @@ -5 +5 @@ -Prepare IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES +Prepare an IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES @@ -15 +15 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ - * Prepare IAM role to access RES environment + * Prepare an IAM role to access RES environment @@ -32 +32 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ -## Prepare IAM role to access RES environment +## Prepare an IAM role to access RES environment @@ -38 +38 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Trusted relationships include the Amazon EC2 service. + * Trusted relationships that include the Amazon EC2 service. @@ -42 +42 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. + * A custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. @@ -49,6 +49 @@ To access the RES environment service from EC2 Image Builder, you must create or -**Trusted relationship entity:** - -JSON - - -**** + 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** @@ -55,0 +51 @@ JSON + 2. Select **JSON** from the policy editor. @@ -57,14 +53 @@ JSON - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - + 3. Copy and paste the policy shown here into the editor, replacing `us-east-1` with your desired AWS Region, `111122223333` with your AWS account ID, and `{RES-EnvironmentName}` with your RES EnvironmentName where applicable. @@ -112,0 +95,41 @@ JSON + 4. Choose **Next** and provide a name and optional description to complete the policy creation. + + 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. + + 6. Under **Trusted Entity Type** , select **"AWS service"**. + + 7. Select **EC2** in the **Service or use case** drop down. + + 8. In the **Use case** section, select **EC2** , then choose **Next**. + + 9. Search for and then select the name of the policy you previously created. + + 10. Choose **Next** and provide a name and optional description to complete the role creation. + + 11. Select your new role and verify that the Trust relationship matches the following: + +**Trusted relationship entity:** + +JSON + + +**** + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] + } + + + + + @@ -288 +311,3 @@ RES supports the following image operating systems: - * Windows 2019, 2022 (x86) + * Windows Server 2019, 2022 (x86) + + * Windows 10, 11 (x86) @@ -323,0 +349,2 @@ For Linux environments, you must add these components in order with the `aws-cli + + @@ -343,0 +371,2 @@ For Linux environments, you must add these components in order with the `aws-cli + + @@ -362 +391 @@ You can use infrastructure configurations to specify the Amazon EC2 infrastructu - 1. For **IAM role** , enter the role you previously configured in Prepare IAM role to access RES environment. + 1. For **IAM role** , enter the role you previously configured in Prepare an IAM role to access RES environment.