AWS resource-explorer documentation change
Summary
Updated documentation to reflect immediate resource discovery capabilities, clarified IAM permission requirements for search functionality, and restructured setup options around cross-region search configurations.
Security assessment
The changes emphasize required IAM permissions (AWSResourceExplorerReadOnlyAccess and AWSResourceExplorerFullAccess) and service-linked role creation, which improves security documentation but does not address a specific disclosed vulnerability. The note about subsequent users only needing read permissions after initial role creation helps prevent excessive privileges but is preventative rather than reactive.
Diff
diff --git a/resource-explorer/latest/userguide/getting-started-setting-up.md b/resource-explorer/latest/userguide/getting-started-setting-up.md index eebb8d613..7a07ac573 100644 --- a//resource-explorer/latest/userguide/getting-started-setting-up.md +++ b//resource-explorer/latest/userguide/getting-started-setting-up.md @@ -5 +5,3 @@ -Quick setupAdvanced setup +Cross-Region searchEnhanced configuration + +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) @@ -9 +11,7 @@ Quick setupAdvanced setup -Before you can set up and configure AWS Resource Explorer, first ensure that you meet the [prerequisites](./getting-started-setting-up-prereqs.html). After that, sign in as an IAM role or user that has the permissions required to perform the Resource Explorer operations for the following procedure. +AWS Resource Explorer is available immediately when you have the appropriate permissions. Users with, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy can start searching for resources right away without any setup. Users with the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy and `iam:CreateServiceLinkedRole` permissions (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy) get complete search results with automatic infrastructure creation on first search. + +###### Note + +After the service-linked role is created in your account when any user with the `iam:CreateServiceLinkedRole` permission accesses Resource Explorer, subsequent users need only, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy to create an index and view for full results in a Region on first search. + +Your search experience is automatically enabled based on your IAM permissions. For enhanced functionality like cross-Region search, multi-account configurations, or more control over your Resource Explorer configuration, you can use the manual setup options below. @@ -11 +19 @@ Before you can set up and configure AWS Resource Explorer, first ensure that you -You can use this set up and configuration procedure to set up Resource Explorer in existing accounts, and in any new accounts added to your organization. +Quick Setup and Advanced Setup options remain available for customers who want cross-Region search or more control over their Resource Explorer configuration. @@ -13 +21 @@ You can use this set up and configuration procedure to set up Resource Explorer -There are two ways to set up Resource Explorer: +###### Note @@ -15 +23 @@ There are two ways to set up Resource Explorer: - * Quick setup +Multi-account search requires that your account is part of an AWS Organizations organization. @@ -17 +25,5 @@ There are two ways to set up Resource Explorer: - * Advanced setup +There are two ways to enhance your Resource Explorer configuration: + + * Enable Cross-Region Search + + * Enhanced Configuration Options @@ -24 +36 @@ There are two ways to set up Resource Explorer: -If you choose to set up Resource Explorer using any option that says "all AWS Regions", it activates only those AWS Regions that exist and that are [enabled in the AWS account](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable) _at the time you perform the procedure_. Resource Explorer does **_not_** automatically turn on in any AWS Regions that AWS adds in the future. When AWS introduces a new Region, you can choose to turn on Resource Explorer in the Region manually when it appears in the **[Settings](https://console.aws.amazon.com/resource-explorer/home#/settings)** page of the Resource Explorer console, or by calling the [CreateIndex](https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_CreateIndex.html) operation. +If you choose to create user-owned indexes using any option that says "all AWS Regions", it creates indexes only in those AWS Regions that exist and that are [enabled in the AWS account](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable) _at the time you perform the procedure_. User-owned indexes are **_not_** automatically created in any AWS Regions that AWS adds in the future. When AWS introduces a new Region, you can choose to create user-owned indexes in the Region manually when it appears in the **[Settings](https://console.aws.amazon.com/resource-explorer/home#/settings)** page of the Resource Explorer console, or by calling the [CreateIndex](https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_CreateIndex.html) operation. @@ -28 +40 @@ If you choose to set up Resource Explorer using any option that says "all AWS Re -Setting up Resource Explorer can also turn on the ability to search for resources by using the unified search bar on the AWS Management Console. For users to see resources in the unified search results, you must configure Resource Explorer with a cross-Region aggregator index and a default view. For details, see the following procedures. You must also ensure that your searching users have permission to use the default view in the AWS Region that contains the aggregator index. For more information, see [Using unified search in the AWS Management Console](./using-unified-search.html). +Configuring Resource Explorer can enhance the ability to search for resources using the [Unified Search](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/using-search.html) bar on the AWS Management Console. Unified Search works with local Region indexes and does not require an aggregator index. For cross-Region search capabilities, you can optionally configure an aggregator index and default view. For more information, see [Using Unified Search in the AWS Management Console](./using-unified-search.html). @@ -30 +42 @@ Setting up Resource Explorer can also turn on the ability to search for resource -## Setting up Resource Explorer using Quick setup +## Enabling cross-Region search @@ -32 +44 @@ Setting up Resource Explorer can also turn on the ability to search for resource -If you choose the Quick setup option, Resource Explorer does the following: +To enable cross-Region search capabilities, you can complete setup to create user-owned indexes and configure an aggregator index. This procedure does the following: @@ -34 +46 @@ If you choose the Quick setup option, Resource Explorer does the following: - * Creates an index in every AWS Region in your AWS account. + * Creates user-owned indexes in every AWS Region in your AWS account for complete search results. @@ -57 +69 @@ AWS Management Console -###### To set up Resource Explorer using Quick setup +###### To enable cross-Region search @@ -61 +73 @@ AWS Management Console - 2. Choose **Turn on Resource Explorer**. + 2. If you see the **Complete setup and enable cross-Region search** banner, proceed to the next step. Otherwise, navigate to **Settings** to access setup options. You can also access **Complete Setup** from the left navigation when available. @@ -63 +75 @@ AWS Management Console - 3. On the **Turn on Resource Explorer** page, choose **Quick setup**. + 3. In the **Complete setup and enable cross-Region search** banner, select your preferred aggregator index from the list. Choose the Region that is appropriate for the geographic location of your users. @@ -65 +77 @@ AWS Management Console - 4. Choose which AWS Region you want to contain the aggregator index. You should select the Region that is appropriate for the geographic location for your users. + 4. Choose **Enable cross-Region search in all Regions**. Alternatively, you can choose **Customize Region setup** for more granular control over which Regions to include. @@ -67 +79 @@ AWS Management Console - 5. At the bottom of the page, choose **Turn on Resource Explorer**. + 5. Monitor the indexing progress. @@ -69 +81 @@ AWS Management Console - 6. On the **Progress** page, you can monitor each AWS Region as Resource Explorer creates its index. The page displays the status of creating the aggregator index and creating the default view. + 6. Wait for the setup to complete. The indexing process creates user-owned indexes in all or selected Regions and configures the aggregator index in your selected Region. @@ -74 +86 @@ AWS Management Console -After all steps show that they completed successfully, you and your users can navigate to the **[Resource search](https://console.aws.amazon.com/resource-explorer/home#/search)** page and begin searching for resources. +After setup completes, you and your users can search for resources across all Regions. The cross-Region search capability will be fully available after indexing is complete. @@ -85,3 +97 @@ AWS CLI -Setting up Resource Explorer in your AWS account by using the AWS CLI is, by definition, equivalent to the **Advanced setup** option. This is because the Resource Explorer CLI operations don't perform any of the steps for you automatically like the Resource Explorer console does. See the AWS CLI tab on the Setting up Resource Explorer using Advanced setup to see what commands are the equivalent of using the console. - -## Setting up Resource Explorer using Advanced setup +Setting up Resource Explorer in your AWS account by using the AWS CLI is, by definition, equivalent to the **Advanced setup** option. This is because the Resource Explorer CLI operations don't perform any of the steps for you automatically like the Resource Explorer console does. See the AWS CLI tab on the Using enhanced configuration options to see what commands are the equivalent of using the console. @@ -89 +99 @@ Setting up Resource Explorer in your AWS account by using the AWS CLI is, by def -If you choose the Advanced setup option, you can do the following: +## Using enhanced configuration options @@ -91 +101 @@ If you choose the Advanced setup option, you can do the following: - * Choose the AWS Regions in which to turn on Resource Explorer. +For more granular control over your Resource Explorer configuration, you can use Advanced setup options to: @@ -93 +103 @@ If you choose the Advanced setup option, you can do the following: - * Choose whether to configure one Region with an [aggregator index](./getting-started-terms-and-concepts.html#term-index). If you do, you specify the AWS Region to place it in. This index allows you to create views that can include resources from all Regions in the account. For more information, see [ Turning on cross-Region search by creating an aggregator index](./manage-aggregator-region.html). + * Choose the AWS Regions in which to create user-owned indexes for complete search results. @@ -95 +105 @@ If you choose the Advanced setup option, you can do the following: - * Choose whether to create a default view. That view allows searching automatically for any AWS resource in the Regions in which you turn on Resource Explorer. You must ensure that any principals who need to use the default view to search in Resource Explorer have permissions on the view. For more information, see [Granting access to Resource Explorer views for search](./configure-views-grant-access.html). + * Choose whether to configure one Region with an [aggregator index](./getting-started-terms-and-concepts.html#term-index). If you do, you specify the AWS Region to place it in. This index allows you to create views that can include resources from all Regions in the account. For more information, see [ Enabling cross-Region search by creating an aggregator index](./manage-aggregator-region.html). @@ -96,0 +107 @@ If you choose the Advanced setup option, you can do the following: + * Choose whether to create a default view. That view allows searching automatically for any AWS resource in the Regions where you have user-owned indexes. You must ensure that any principals who need to use the default view to search in Resource Explorer have permissions on the view. For more information, see [Granting access to Resource Explorer views for search](./configure-views-grant-access.html). @@ -100,3 +110,0 @@ If you choose the Advanced setup option, you can do the following: -###### Note - -You can configure Resource Explorer to include your resources in the search results provided by the unified search feature on the AWS Management Console. To turn on this feature, you must configure Resource Explorer with an aggregator index and a default view that all roles and users can search with. The Quick setup option creates both the aggregator index and default view and is the way we recommend that you turn on Resource Explorer. @@ -118 +126 @@ AWS Management Console -###### To turn on Resource Explorer using Advanced setup +###### To configure Resource Explorer with enhanced options @@ -122 +130 @@ AWS Management Console - 2. Choose **Turn on Resource Explorer**. + 2. Navigate to **Settings** to access enhanced configuration options, or choose **Customize Region setup** from the cross-Region setup banner. You can also access **Complete Setup** from the left navigation when available. @@ -124 +132 @@ AWS Management Console - 3. On the **Turn on Resource Explorer** page, choose **Advanced setup**. + 3. Select the specific Regions where you want to create user-owned indexes, or configure custom view settings as needed. @@ -126 +134 @@ AWS Management Console - 4. In the **AWS Regions** box, under **Regions** , choose whether you want to turn on Resource Explorer in all AWS Regions, or only specific Regions. + 4. If enabling cross-Region search, review the "Confirm cross-Region setup" modal that explains: "By enabling cross-Region search, AWS performs the following steps:" followed by details about creating indexes in all AWS Regions, creating the aggregator index, and creating default view with filter. @@ -128 +136 @@ AWS Management Console -If you choose **Turn on Resource Explorer in only the specified AWS Regions in this account** , select each Region whose resources you want to include in search results. + 5. Choose **Cancel** to return to the previous screen, or **Confirm and enable** to proceed with the cross-Region setup. @@ -130,13 +138 @@ If you choose **Turn on Resource Explorer in only the specified AWS Regions in t - 5. For **Aggregator index** , choose whether you want to create an aggregator index. If you choose to create an aggregator index, all other AWS Regions replicate their indexes to this Region. This lets users search for resources across all selected Regions in the AWS account. Choose the AWS Region that contains the aggregator index. We recommend that you specify the Region where your users spend most of their time, or at least where you expect them to perform most of their resource searches. - - 6. In the **Default view** box, under **View creation** , choose whether to create a default view. This option is available only if you chose to create an aggregator index. If you choose to create a default view, Resource Explorer places this view in the same AWS Region as the aggregator index. This lets the default view include results from all AWS Regions in which you registered Resource Explorer. Whenever a user performs a search in a Region with a default view and doesn't explicitly specify a view, the search uses the default view for that Region. - -###### Note - -Before your users can search with a view, you must grant them permissions to use that view. For more information, see [Granting access to Resource Explorer views for search](./configure-views-grant-access.html). - - 7. Choose **Activate Resource Explorer**. - -###### Note - -Tagged resources local to the index appear in search results within a few minutes. Untagged resources typically take less than two hours to appear, but can take longer when there is heavy demand. It can also can take up to an hour to complete the initial replication to a new aggregator index from all of the existing local indexes. + 6. Monitor the setup progress and wait for indexing to complete. To continue using Resource Explorer with partial results during this process, choose **Proceed to Resource Search**. @@ -154 +150 @@ The Resource Explorer console performs many API operation calls on your behalf b -###### Example Step 1: Turn on Resource Explorer by creating indexes in the desired AWS Regions +###### Example Step 1: Create user-owned indexes in the desired AWS Regions @@ -156 +152 @@ The Resource Explorer console performs many API operation calls on your behalf b -Run the following command in each AWS Region in which you want to activate Resource Explorer. The following example command turns on Resource Explorer in the AWS Region that is the default for the AWS CLI. +Run the following command in each AWS Region in which you want to activate Resource Explorer. The following example command enables Resource Explorer in the AWS Region that is the default for the AWS CLI. @@ -233 +229 @@ Prerequisites -Identify Resource Explorer status in AWS Regions +Immediate resource discovery experience