AWS res documentation change
Summary
Restructured permission profiles documentation into topic-based sections with external links, removed detailed permission descriptions and management instructions, added new sections for environment boundaries and desktop sharing profiles
Security assessment
The changes reorganize existing security-related content about permission management but do not introduce new security fixes or vulnerabilities. While permissions are security-adjacent, the restructuring itself doesn't address specific vulnerabilities. The addition of environment boundaries and desktop sharing profile links suggests expanded documentation rather than new security features.
Diff
diff --git a/res/archive/release-minus-4/ug/permission-profiles.md b/res/archive/release-minus-4/ug/permission-profiles.md index 3a85f9f91..36abbbf24 100644 --- a//res/archive/release-minus-4/ug/permission-profiles.md +++ b//res/archive/release-minus-4/ug/permission-profiles.md @@ -5 +5 @@ -Overview Managing permission profiles Default permissions profiles +# Permission policy @@ -7,5 +7 @@ Overview Managing permission profiles Default permissions profiles -# Permission profiles - -## Overview - -Research and Engineering Studio (RES) allows an administrative user to create custom permission profiles that grant selected users additional permissions to manage the project that they are part of. Each project comes with two default permission profiles\- "Project Member" and "Project Owner" that can be customized after deployment. +Research and Engineering Studio (RES) allows an administrative user to create custom permission profiles that grant selected users additional permissions to manage the project that they are part of. Each project comes with two [default permission profiles](./permission-matrix.html)\- "Project Member" and "Project Owner" that can be customized after deployment. @@ -24,85 +20 @@ In this way, administrators can delegate project-based permissions to non-admini -### Project management permissions - -**Update project membership** - - -This permission allows non-admin users who have been granted it to add and remove users or groups from a project. It also allows them to set the permission profile and decide the access level for all other users and groups for that project. - - - -**Update project status** - - -This permission allows non-admin users who have been granted it to enable or disable a project using the **Actions** button on the **Projects** page. - - - -### VDI session management permissions - -**Create a session** - - -Controls whether or not a user is allowed to launch their own VDI session from the **My Virtual Desktops** page. Disable this to deny non-admin users the ability to launch their own VDI sessions. Users can always stop and terminate their own VDI sessions. - -If a non-admin user does not have permissions to create a session, the **Launch New Virtual Desktop** button will be disabled for them as shown here: - - - -**Create or Terminate the sessions of others** - - -Allows non-admin users to access the **Sessions** page from the left-hand navigation pane. These users will be able to launch VDI sessions for other users in the projects where they have been granted this permission. - -If a non-admin user has permission to launch sessions for other users, their left-hand navigation pane will display the **Sessions** link under **Session Management** as shown here: - - - -If a non-admin user does not have permission to create sessions for others, their left-hand navigation pane will not display **Session Management** as shown here: - - - -## Managing permission profiles - -As a RES administrator, you can perform the following actions to manage permission profiles. - -###### List permission profiles - - * From the Research and Engineering Studio console page, select **Permission Profiles** in the left-hand navigation pane. From this page you can create, update, list, view and delete permission profiles. - - - - - - -###### View permission profiles - - 1. On the main **Permission Profiles** page, select the name of the permission profile you want to view. From this page you can edit or delete the selected permission profile. - - - - 2. Select the **Affected projects** tab to view the projects that currently use the permission profile. - - - - - - -###### Create permission profiles - - 1. On the main **Permission Profiles** page, select **Create profile** to create a permission profile. - - 2. Enter a permission profile name and description, then choose the permissions to grant to the users or groups that you assign to this profile. - - - - - - -###### Edit permission profiles - - * On the main **Permission Profiles** page, choose a profile by clicking the circle next to it, select **Actions** , then choose **Edit profile** to update that permission profile. - - - - - +###### Topics @@ -110 +22 @@ As a RES administrator, you can perform the following actions to manage permissi -###### Delete permission profiles + * [Project management permissions](./permission-profiles-permission-project-management.html) @@ -112 +24 @@ As a RES administrator, you can perform the following actions to manage permissi - * On the main **Permission Profiles** page, choose a profile by clicking the circle next to it, select **Actions** , then select **Delete profile**. You cannot delete a permission profile that is used by any existing project. + * [VDI session management permissions](./permission-profiles-permission-vdi-sessions.html) @@ -114 +26 @@ As a RES administrator, you can perform the following actions to manage permissi - + * [Managing permission profiles ](./permission-profiles-permission-management.html) @@ -115,0 +28 @@ As a RES administrator, you can perform the following actions to manage permissi + * [Default permissions profiles](./permission-matrix.html) @@ -116,0 +30 @@ As a RES administrator, you can perform the following actions to manage permissi + * [Environment Boundaries](./permission-profiles-environment-boundaries.html) @@ -117,0 +32 @@ As a RES administrator, you can perform the following actions to manage permissi + * [Desktop sharing profiles](./permission-profiles-desktop-sharing-profiles.html) @@ -119 +33,0 @@ As a RES administrator, you can perform the following actions to manage permissi -## Default permissions profiles @@ -121 +34,0 @@ As a RES administrator, you can perform the following actions to manage permissi -Every RES project comes with two default permission profiles that Global Administrators can configure. (In addition, Global Administrators can create and modify new permission profiles for a project.) The following table shows the allowed permissions for the default permission profiles- "Project Member" and "Project Owner". Permission profiles, and the permissions they grant to select users of a project, only apply to the project that they belong to; Global Administrators are super users who have all the permissions below across all projects. @@ -123,6 +35,0 @@ Every RES project comes with two default permission profiles that Global Adminis -Permissions | Description | Project Member | Project Owner ----|---|---|--- -Create Session | Create your own session. Users can always stop and terminate their own sessions with or without this permission. | X | X -Create/terminate others' sessions | Create or terminate another user's session within a project. | | X -Update Project membership | Update users and groups associated with a project. | | X -Update Project Status | Enable or disable a project. | | X @@ -136 +43 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Groups +Add a launch template @@ -138 +45 @@ Groups -File Systems +Project management permissions