AWS amazonglacier documentation change
Summary
Updated product naming from 'S3 Glacier' to 'Glacier' or 'Amazon Glacier' across documentation, removed JSON policy examples for cross-account permissions and MFA delete operations, and adjusted related links/text.
Security assessment
The changes primarily involve branding updates (renaming 'S3 Glacier' to 'Glacier') and removal of specific JSON policy examples. While MFA-related text remains, the removal of policy examples reduces implementation clarity but does not directly address or introduce a security vulnerability. No evidence of patching a security flaw or incident response.
Diff
diff --git a/amazonglacier/latest/dev/vault-access-policy.md b/amazonglacier/latest/dev/vault-access-policy.md index 2153236dc..0ccbee3d5 100644 --- a//amazonglacier/latest/dev/vault-access-policy.md +++ b//amazonglacier/latest/dev/vault-access-policy.md @@ -5 +5 @@ -Example 1: Grant Cross-Account Permissions for Specific Amazon S3 Glacier ActionsExample 2: Grant Cross-Account Permissions for MFA Delete Operations +Example 1: Grant Cross-Account Permissions for Specific Amazon Glacier ActionsExample 2: Grant Cross-Account Permissions for MFA Delete Operations @@ -7 +7 @@ Example 1: Grant Cross-Account Permissions for Specific Amazon S3 Glacier Action -**This page is only for existing customers of the S3 Glacier service using Vaults and the original REST API from 2012.** +**This page is only for existing customers of the Glacier service using Vaults and the original REST API from 2012.** @@ -9 +9 @@ Example 1: Grant Cross-Account Permissions for Specific Amazon S3 Glacier Action -If you're looking for archival storage solutions we suggest using the S3 Glacier storage classes in Amazon S3, **S3 Glacier Instant Retrieval** , **S3 Glacier Flexible Retrieval** , and **S3 Glacier Deep Archive**. To learn more about these storage options, see [S3 Glacier storage classes](https://aws.amazon.com/s3/storage-classes/glacier/) and [Long-term data storage using S3 Glacier storage classes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/glacier-storage-classes) in the _Amazon S3 User Guide_. These storage classes use the Amazon S3 API, are available in all regions, and can be managed within the Amazon S3 console. They offer features like Storage Cost Analysis, Storage Lens, advanced optional encryption features, and more. +If you're looking for archival storage solutions we suggest using the Glacier storage classes in Amazon S3, **S3 Glacier Instant Retrieval** , **S3 Glacier Flexible Retrieval** , and **S3 Glacier Deep Archive**. To learn more about these storage options, see [Glacier storage classes](https://aws.amazon.com/s3/storage-classes/glacier/) and [Long-term data storage using Glacier storage classes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/glacier-storage-classes) in the _Amazon S3 User Guide_. These storage classes use the Amazon S3 API, are available in all regions, and can be managed within the Amazon S3 console. They offer features like Storage Cost Analysis, Storage Lens, advanced optional encryption features, and more. @@ -13 +13 @@ If you're looking for archival storage solutions we suggest using the S3 Glacier -An Amazon S3 Glacier vault access policy is a resource-based policy that you can use to manage permissions to your vault. +An Amazon Glacier vault access policy is a resource-based policy that you can use to manage permissions to your vault. @@ -15 +15 @@ An Amazon S3 Glacier vault access policy is a resource-based policy that you can -You can create one vault access policy for each vault to manage _permissions_. You can modify permissions in a vault access policy at any time. S3 Glacier also supports a Vault Lock policy on each vault that, after you lock it, cannot be altered. For more information about working with Vault Lock policies, see [Vault Lock Policies](./vault-lock-policy.html). +You can create one vault access policy for each vault to manage _permissions_. You can modify permissions in a vault access policy at any time. Glacier also supports a Vault Lock policy on each vault that, after you lock it, cannot be altered. For more information about working with Vault Lock policies, see [Vault Lock Policies](./vault-lock-policy.html). @@ -19 +19 @@ You can create one vault access policy for each vault to manage _permissions_. Y - * Example 1: Grant Cross-Account Permissions for Specific Amazon S3 Glacier Actions + * Example 1: Grant Cross-Account Permissions for Specific Amazon Glacier Actions @@ -26 +26 @@ You can create one vault access policy for each vault to manage _permissions_. Y -## Example 1: Grant Cross-Account Permissions for Specific Amazon S3 Glacier Actions +## Example 1: Grant Cross-Account Permissions for Specific Amazon Glacier Actions @@ -28 +28 @@ You can create one vault access policy for each vault to manage _permissions_. Y -The following example policy grants cross-account permissions to two AWS accounts for a set of S3 Glacier operations on a vault named `examplevault`. +The following example policy grants cross-account permissions to two AWS accounts for a set of Glacier operations on a vault named `examplevault`. @@ -34,27 +33,0 @@ The account that owns the vault is billed for all costs associated with the vaul - - { - "Version":"2012-10-17", - "Statement":[ - { - "Sid":"cross-account-upload", - "Principal": { - "AWS": [ - "arn:aws:iam::123456789012:root", - "arn:aws:iam::444455556666:root" - ] - }, - "Effect":"Allow", - "Action": [ - "glacier:UploadArchive", - "glacier:InitiateMultipartUpload", - "glacier:AbortMultipartUpload", - "glacier:CompleteMultipartUpload" - ], - "Resource": [ - "arn:aws:glacier:us-west-2:999999999999:vaults/examplevault" - ] - } - ] - } - - @@ -63 +36 @@ The account that owns the vault is billed for all costs associated with the vaul -You can use multi-factor authentication (MFA) to protect your S3 Glacier resources. To provide an extra level of security, MFA requires users to prove physical possession of an MFA device by providing a valid MFA code. For more information about configuring MFA access, see [Configuring MFA-Protected API Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html) in the _IAM User Guide_. +You can use multi-factor authentication (MFA) to protect your Glacier resources. To provide an extra level of security, MFA requires users to prove physical possession of an MFA device by providing a valid MFA code. For more information about configuring MFA access, see [Configuring MFA-Protected API Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html) in the _IAM User Guide_. @@ -67,28 +39,0 @@ The example policy grants an AWS account with temporary credentials permission t - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "add-mfa-delete-requirement", - "Principal": { - "AWS": [ - "arn:aws:iam::123456789012:root" - ] - }, - "Effect": "Allow", - "Action": [ - "glacier:Delete*" - ], - "Resource": [ - "arn:aws:glacier:us-west-2:999999999999:vaults/examplevault" - ], - "Condition": { - "Bool": { - "aws:MultiFactorAuthPresent": true - } - } - } - ] - } - -