AWS res medium security documentation change
Summary
Updated user authentication workflow to clarify temporary password usage, SSO requirements, and password reset process
Security assessment
The changes enforce password reset requirements (temporary password rotation on first login) and emphasize proper SSO configuration. This addresses credential management security by preventing default/static passwords and ensuring proper access control through SSO.
Diff
diff --git a/res/archive/release-minus-3/ug/create-demo-env.md b/res/archive/release-minus-3/ug/create-demo-env.md index 7a00bff65..260a770cd 100644 --- a//res/archive/release-minus-3/ug/create-demo-env.md +++ b//res/archive/release-minus-3/ug/create-demo-env.md @@ -97 +97,3 @@ InboundPrefixList | | _(Optional)_ Provide a managed prefix list for IPs allowe - 1. Reset user passwords in `AWS Directory Service`– The demo stack creates four users with usernames which you can use: `admin1`, `user1`, `admin2`, and `user2`. + 1. You can now log in to the demo environment using the clusteradmin user and the temporary password sent to the administrator email you entered during setup. You are prompted to create a new password on your first log in. + + 2. If you want to use the "Sign in with organization SSO" feature, you must first reset the passwords for each user you would like to log in as. You can reset user passwords from the AWS Directory Service. The demo stack creates four users with usernames which you can use: admin1, user1, admin2, and user2. @@ -101 +103 @@ InboundPrefixList | | _(Optional)_ Provide a managed prefix list for IPs allowe - 2. Select the Directory Id for your environment. You can get the Directory Id from the output of `<StackName>*DirectoryService*` stack. + 2. Select the Directory Id for your environment. You can get the Directory Id from the output of the `<StackName>*DirectoryService*` stack. @@ -105 +107 @@ InboundPrefixList | | _(Optional)_ Provide a managed prefix list for IPs allowe - 4. For all the users you want to use, put the username and type in the password you want to have and choose **Reset Password**. + 4. For all the users you want to use, enter the username, type in the new password you want and then choose **Reset Password**. @@ -107 +109 @@ InboundPrefixList | | _(Optional)_ Provide a managed prefix list for IPs allowe - 2. Once you have reset the user passwords, you will need to wait for Research and Engineering Studio to sync the users in the environment. Research and Engineering Studio syncs the users every hour at xx.00. You can either wait for that to happen or follow the steps listed in [User added in Active Directory, but missing from RES](./res-troubleshooting-issue-runbooks.html#user-missing) to sync the users immediately. + 3. Once you have reset the user passwords, proceed to the single sign in log in page to access the environment.