AWS res medium security documentation change
Summary
Parameter updates: EnvironmentName character restrictions, VpcId clarification, ServiceAccount credentials consolidated into a single secret ARN, removed SudoersOU parameter
Security assessment
Changes to ServiceAccountCredentialsSecretArn (combining username/password in one secret) improve credential management security. Removal of SudoersOU may reduce privilege escalation risks. EnvironmentName restrictions prevent naming convention violations that could cause deployment issues.
Diff
diff --git a/res/archive/release-minus-4/ug/launch-the-product.md b/res/archive/release-minus-4/ug/launch-the-product.md index d9a21ae72..8ad217423 100644 --- a//res/archive/release-minus-4/ug/launch-the-product.md +++ b//res/archive/release-minus-4/ug/launch-the-product.md @@ -39 +39 @@ Parameter | Default | Description -EnvironmentName | `<_res-demo_ >` | A unique name given to your RES environment starting with res- and no longer than 11 characters. +EnvironmentName | `<_res-demo_ >` | A unique name given to your RES environment starting with res-, no longer than 11 characters, and no capital letters. @@ -46 +46 @@ IAMPermissionBoundary | | _(Optional)_ You may provide a managed policy ARN tha -VpcId | | IP for the VPC where instances will launch. +VpcId | | ID for the VPC where instances will launch. @@ -48 +48 @@ IsLoadBalancerInternetFacing | | Select true to deploy internet facing load bal -LoadBalancerSubnets | | Select at least two subnets in different Availability Zones where load balancers will launch. For deployments that need restricted internet access, choose private subnets. For deployments that need internet access, choose public subnets. If more than two were created by the external networking stack, select all that were created. +LoadBalancerSubnets | | Select at least two subnets in different Availability Zones where load balancers will launch. For deployments that need restricted internet access, select private subnets. For deployments that need internet access, select public subnets. If more than two were created by the external networking stack, select all that were created. @@ -55,2 +55 @@ LDAPConnectionURI | | A single ldap:// path that can be reached by the active d -ServiceAccountUserName | ServiceAccount | Username for a service account used to connect to AD. This account must have access to create computers within the ComputersOU. -ServiceAccountPasswordSecretArn | | Provide a Secret ARN which contains the plaintext password for the ServiceAccount. +ServiceAccountCredentialsSecretArn | | Provide a Secret ARN which contains the username and password for the Active Directory ServiceAccount user, formatted as a username:password key/value pair. @@ -59 +57,0 @@ GroupsOU | | Organizational unit within AD for groups that will sync. -SudoersOU | | Organizational unit within AD for global sudoers.