AWS detective documentation change
Summary
Updated IAM policy examples with specific ARNs and formatting
Security assessment
Replaces placeholder account IDs and roles with concrete examples. No security implications beyond policy clarity.
Diff
diff --git a/detective/latest/userguide/resource-share-arn.md b/detective/latest/userguide/resource-share-arn.md index 5ba037652..000a88337 100644 --- a//detective/latest/userguide/resource-share-arn.md +++ b//detective/latest/userguide/resource-share-arn.md @@ -46,0 +47,6 @@ You must create an AWS CloudFormation service role to create a stack using the A +JSON + + +**** + + @@ -79,2 +85,5 @@ You must create an AWS CloudFormation service role to create a stack using the A - "arn:aws:iam::<ACCOUNT ID>:role/*", - "arn:aws:iam::<ACCOUNT ID>:policy/*" + "arn:aws:iam::111122223333:role/*-ResourceShareAcceptorLamb-*", + "arn:aws:iam::111122223333:role/*-SsmParametersLambdaRole-*", + "arn:aws:iam::111122223333:role/*-GlueDatabaseLambdaRole-*", + "arn:aws:iam::111122223333:role/*-GlueTablesLambdaRole-*", + "arn:aws:iam::111122223333:policy/*" @@ -110 +119 @@ You must create an AWS CloudFormation service role to create a stack using the A - "arn:aws:lambda:*:<ACCOUNT ID>:function:*" + "arn:aws:lambda:*:111122223333:function:*" @@ -121 +130 @@ You must create an AWS CloudFormation service role to create a stack using the A - "Resource": "arn:aws:logs:*:<ACCOUNT ID>:log-group:*" + "Resource": "arn:aws:logs:*:111122223333:log-group:*" @@ -129 +138 @@ You must create an AWS CloudFormation service role to create a stack using the A - "Resource": "arn:aws:kms:*:<ACCOUNT ID>:key/*" + "Resource": "arn:aws:kms:*:111122223333:key/*" @@ -144,0 +154,6 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol +JSON + + +**** + + @@ -152,2 +167 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol - "Action": - [ + "Action": [ @@ -157 +171 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol - "Resource": "arn:aws:iam::<ACCOUNT ID>:role/CFN-DetectiveSecurityLakeIntegration" + "Resource": "arn:aws:iam::111122223333:role/CFN-DetectiveSecurityLakeIntegration" @@ -167 +181 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol - "Resource": "arn:aws:cloudformation:*:<ACCOUNT ID>:stack/*", + "Resource": "arn:aws:cloudformation:*:111122223333:stack/*", @@ -171 +185 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol - "arn:aws:iam::<ACCOUNT ID>:role/CFN-DetectiveSecurityLakeIntegration" + "arn:aws:iam::111122223333:role/CFN-DetectiveSecurityLakeIntegration" @@ -184 +198 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol - "Resource": "arn:aws:cloudformation:*:<ACCOUNT ID>:stack/*" + "Resource": "arn:aws:cloudformation:*:111122223333:stack/*" @@ -200 +214 @@ In the following policy, `CFN-DetectiveSecurityLakeIntegration` used in this pol - "Resource": "arn:aws:logs:*:<ACCOUNT ID>:log-group:*" + "Resource": "arn:aws:logs:*:111122223333:log-group:*"