AWS AmazonRDS medium security documentation change
Summary
Updated IAM policy documentation with expanded S3 permissions (GetBucketAcl, GetBucketLocation, ListAllMyBuckets), restructured policy examples into separate JSON blocks, and added region parameter in CLI commands
Security assessment
Added critical s3:GetBucketAcl permission which controls access to bucket ACLs - improper configuration could lead to privilege escalation. Added explicit region parameter in CLI commands to prevent misconfiguration. Restructured policy examples improve security hygiene by demonstrating least-privilege principles with specific resource ARNs.
Diff
diff --git a/AmazonRDS/latest/UserGuide/db2-s3-integration.md b/AmazonRDS/latest/UserGuide/db2-s3-integration.md index a61014002..ad3281f1b 100644 --- a//AmazonRDS/latest/UserGuide/db2-s3-integration.md +++ b//AmazonRDS/latest/UserGuide/db2-s3-integration.md @@ -41 +41 @@ Before you create the policy, note the following pieces of information: -Create an IAM policy that includes the following permissions: +The IAM policy that you create should contain the following information. Replace `{amzn-s3-demo-bucket}` with the name of your S3 bucket. @@ -42,0 +43 @@ Create an IAM policy that includes the following permissions: +JSON @@ -43,0 +45,12 @@ Create an IAM policy that includes the following permissions: + +**** + + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "AllowS3BucketAccess", + "Effect": "Allow", + "Action": [ @@ -50 +62,0 @@ Create an IAM policy that includes the following permissions: - "s3:DeleteObject", @@ -52 +64,22 @@ Create an IAM policy that includes the following permissions: - "s3:ListMultipartUploadParts" + "s3:ListMultipartUploadParts", + "s3:GetBucketAcl", + "s3:GetBucketLocation" + ], + "Resource": [ + "arn:aws:s3:::${amzn-s3-demo-bucket}/*", + "arn:aws:s3:::${amzn-s3-demo-bucket}" + ] + }, + { + "Effect": "Allow", + "Action": [ + "s3:ListAllMyBuckets" + ], + "Resource": [ + "*" + ] + } + ] + } + + @@ -81 +114 @@ You can create an IAM policy by using the AWS Management Console or the AWS Comm - 1. Run the [create-policy](https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html) command. In the following example, replace `iam_policy_name` and `s3_bucket_name` with a name for your IAM policy and the name of the Amazon S3 bucket where your RDS for Db2 database resides. + 1. Create a JSON file that contains the following JSON policy document. Replace `{amzn-s3-demo-bucket}` with the name of your S3 bucket. @@ -83 +116 @@ You can create an IAM policy by using the AWS Management Console or the AWS Comm -For Linux, macOS, or Unix: +JSON @@ -85,3 +118,5 @@ For Linux, macOS, or Unix: - aws iam create-policy \ - --policy-name iam_policy_name \ - --policy-document '{ + +**** + + + { @@ -90,0 +126 @@ For Linux, macOS, or Unix: + "Sid": "AllowS3BucketAccess", @@ -99 +134,0 @@ For Linux, macOS, or Unix: - "s3:DeleteObject", @@ -101 +136,3 @@ For Linux, macOS, or Unix: - "s3:ListMultipartUploadParts" + "s3:ListMultipartUploadParts", + "s3:GetBucketAcl", + "s3:GetBucketLocation" @@ -104,4 +141,2 @@ For Linux, macOS, or Unix: - "arn:aws:s3:::s3_bucket_name/*", - "arn:aws:s3:::s3_bucket_name" - ] - } + "arn:aws:s3:::${amzn-s3-demo-bucket}/*", + "arn:aws:s3:::${amzn-s3-demo-bucket}" @@ -109,9 +144 @@ For Linux, macOS, or Unix: - }' - -For Windows: - - aws iam create-policy ^ - --policy-name iam_policy_name ^ - --policy-document '{ - "Version": "2012-10-17", - "Statement": [ + }, @@ -121,7 +148 @@ For Windows: - "s3:PutObject", - "s3:GetObject", - "s3:AbortMultipartUpload", - "s3:ListBucket", - "s3:DeleteObject", - "s3:GetObjectVersion", - "s3:ListMultipartUploadParts" + "s3:ListAllMyBuckets" @@ -130,2 +151 @@ For Windows: - "arn:aws:s3:::s3_bucket_name/*", - "arn:aws:s3:::s3_bucket_name" + "*" @@ -135 +155,17 @@ For Windows: - }' + } + + + + 2. Run the [create-policy](https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html) command. In the following example, replace `iam_policy_name` and `iam_policy_file_name` with a name for your IAM policy and the name of the JSON file you created in Step 1. + +For Linux, macOS, or Unix: + + aws iam create-policy \ + --policy-name iam_policy_name \ + --policy-document file://iam_policy_file_name.json + +For Windows: + + aws iam create-policy ^ + --policy-name iam_policy_name ^ + --policy-document file://iam_policy_file_name.json @@ -137 +173 @@ For Windows: - 2. After the policy is created, note the ARN of the policy. You need the ARN for Step 2: Create an IAM role and attach your IAM policy. + 3. After the policy is created, note the ARN of the policy. You need the ARN for Step 2: Create an IAM role and attach your IAM policy. @@ -179 +215 @@ You can create an IAM role for your DB instance by using the AWS Management Cons - 1. Run the [create-role](https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html) command. In the following example, replace `iam_role_name` with a name for your IAM role. + 1. Create a JSON file that contains the following JSON policy document: @@ -181 +217 @@ You can create an IAM role for your DB instance by using the AWS Management Cons -For Linux, macOS, or Unix: +JSON @@ -183,3 +219,5 @@ For Linux, macOS, or Unix: - aws iam create-role \ - --role-name iam_role_name \ - --assume-role-policy-document '{ + +**** + + + { @@ -196 +234,11 @@ For Linux, macOS, or Unix: - }' + } + + + + 2. Run the [create-role](https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html) command. In the following example, replace `iam_role_name` and `iam_assume_role_policy_file_name` with a name for your IAM role and the name of the JSON file that you created in Step 1. + +For Linux, macOS, or Unix: + + aws iam create-role \ + --role-name iam_role_name \ + --assume-role-policy-document file://iam_assume_role_policy_file_name.json @@ -202,12 +250 @@ For Windows: - --assume-role-policy-document '{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "rds.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - }' + --assume-role-policy-document file://iam_assume_role_policy_file_name.json @@ -215 +252 @@ For Windows: - 2. After the role is created, note the ARN of the role. You need the ARN for Step 3: Add your IAM role to your RDS for Db2 DB instance. + 3. After the role is created, note the ARN of the role. You need the ARN for Step 3: Add your IAM role to your RDS for Db2 DB instance. @@ -217 +254 @@ For Windows: - 3. Run the [attach-role-policy](https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html) command. In the following example, replace `iam_policy_arn` with the ARN of the IAM policy that you created in Step 1: Create an IAM policy. Replace `iam_role_name` with the name of the IAM role that you just created. + 4. Run the [attach-role-policy](https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html) command. In the following example, replace `iam_policy_arn` with the ARN of the IAM policy that you created in Step 1: Create an IAM policy. Replace `iam_role_name` with the name of the IAM role that you just created. @@ -272 +309 @@ You can add an IAM role to your DB instance by using the AWS Management Console -To add an IAM role to your RDS for Db2 DB instance, run the [add-role-to-db-instance](https://docs.aws.amazon.com/cli/latest/reference/rds/add-role-to-db-instance.html) command. In the following example, replace `db_instance_name` and `iam_role_arn` with the name of your DB instance and the ARN of the IAM role that you created in Step 2: Create an IAM role and attach your IAM policy. +To add an IAM role to your RDS for Db2 DB instance, run the [add-role-to-db-instance](https://docs.aws.amazon.com/cli/latest/reference/rds/add-role-to-db-instance.html) command. In the following example, replace `region`, `db_instance_name`, and `iam_role_arn` with the name of the AWS Region where your DB instance exists, the name of your DB instance, and the ARN of the IAM role that you created in Step 2: Create an IAM role and attach your IAM policy. @@ -278 +315,2 @@ For Linux, macOS, or Unix: - --db-instance-identifier db_instance_name \ + --region $region \ + --db-instance-identifier $db_instance_name \ @@ -280 +318 @@ For Linux, macOS, or Unix: - --role-arn iam_role_arn \ + --role-arn $iam_role_arn \ @@ -285,0 +324 @@ For Windows: + --region $region \