AWS res documentation change
Summary
Updated IAM policy examples with improved formatting, added new DynamoDB condition keys, expanded S3 resource ARNs, updated RHEL versions, and fixed SSM agent documentation links
Security assessment
The changes enhance security documentation by expanding IAM policy conditions (adding 'cluster-manager.host_modules.*' and 'identity-provider.cognito.enable_native_user_login' DynamoDB condition keys) and refining resource ARN patterns. These updates demonstrate improved least-privilege practices but don't reference a specific security vulnerability.
Diff
diff --git a/res/archive/release-minus-4/ug/res-ready-ami.md b/res/archive/release-minus-4/ug/res-ready-ami.md index 60486a731..94c8c070d 100644 --- a//res/archive/release-minus-4/ug/res-ready-ami.md +++ b//res/archive/release-minus-4/ug/res-ready-ami.md @@ -9 +9 @@ Prepare IAM role to access RES environmentCreate EC2 Image Builder componentPrep -With RES-ready AMIs, you can pre-install RES dependencies for virtual desktop instances (VDIs) on your custom AMIs. Using RES-ready AMIs improve boot times for VDI instances using the pre-baked images. Using EC2 Image Builder, you can build and register your AMIs as new software stacks. For more information on Image Builder, see the [Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html). +With RES-ready Amazon Machine Images (AMIs), you can pre-install RES dependencies for virtual desktop instances (VDIs) on your custom AMIs. Using RES-ready AMIs improve boot times for VDI instances using the pre-baked images. Using EC2 Image Builder, you can build and register your AMIs as new software stacks. For more information on Image Builder, see the [ Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html). @@ -38 +38 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Trusted relationships include the Amazon EC2 service + * Trusted relationships include the Amazon EC2 service. @@ -40 +40 @@ To access the RES environment service from EC2 Image Builder, you must create or - * AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies + * AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. @@ -42 +42 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment + * Custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. @@ -44 +44 @@ To access the RES environment service from EC2 Image Builder, you must create or -(This policy can be either a customer managed or customer inline policy document. To use the policy shown here, replace `us-east-1` with your desired AWS Region, `123456789012` with your AWS AccountID, and `{RES_ENVIRONMENT_NAME}` with your RES EnvironmentName.) +(This policy can be either a customer managed or customer inline policy document.) @@ -50,0 +51,6 @@ To access the RES environment service from EC2 Image Builder, you must create or +JSON + + +**** + + @@ -66,0 +74,6 @@ To access the RES environment service from EC2 Image Builder, you must create or +JSON + + +**** + + @@ -75 +88 @@ To access the RES environment service from EC2 Image Builder, you must create or - "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/{RES_ENVIRONMENT_NAME}.cluster-settings", + "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/{RES-EnvironmentName}.cluster-settings", @@ -80 +93,3 @@ To access the RES environment service from EC2 Image Builder, you must create or - "global-settings.package_config.*" + "global-settings.package_config.*", + "cluster-manager.host_modules.*", + "identity-provider.cognito.enable_native_user_login" @@ -89 +104,4 @@ To access the RES environment service from EC2 Image Builder, you must create or - "Resource": "arn:aws:s3:::{RES_ENVIRONMENT_NAME}-cluster-us-east-1-123456789012/idea/vdc/res-ready-install-script-packages/*" + "Resource": [ + "arn:aws:s3:::{RES-EnvironmentName}-cluster-us-east-1-111122223333/idea/vdc/res-ready-install-script-packages/*", + "arn:aws:s3:::research-engineering-studio-us-east-1/host_modules/*" + ] @@ -266,0 +286,2 @@ RES supports the following image operating systems: + * RHEL 8 (x86), and 9 (x86) + @@ -283 +304 @@ Create a new recipe - 5. Choose a base image supported by RES. + 5. Select a base image supported by RES. @@ -291 +312 @@ For information on how to install an SSM agent, see: - * [Manually installing SSM Agent on EC2 instances for Linux](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.html) + * [ Manually installing SSM Agent on EC2 instances for Linux](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.html). @@ -293 +314 @@ For information on how to install an SSM agent, see: - * [Manually installing and uninstalling SSM Agent on EC2 instances for Windows Server](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-install-win.html) + * [ Manually installing and uninstalling SSM Agent on EC2 instances for Windows Server](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-install-win.html). @@ -359 +380 @@ Create a new Image Builder pipeline - 2. From the navigation, choose **Image pipelines**. + 2. From the navigation pane, choose **Image pipelines**.