AWS resource-explorer documentation change
Summary
Updated documentation to reflect automatic enablement of Resource Explorer based on IAM permissions, added details about immediate access with partial results, and enhanced setup options for cross-Region search.
Security assessment
The changes emphasize IAM permission requirements (AWSResourceExplorerReadOnlyAccess/FullAccess) and access denial for unauthorized users, documenting security controls rather than fixing vulnerabilities. While it clarifies security boundaries, there's no evidence of addressing a specific security incident.
Diff
diff --git a/resource-explorer/latest/userguide/getting-started.md b/resource-explorer/latest/userguide/getting-started.md index 07f20eeb1..50330d744 100644 --- a//resource-explorer/latest/userguide/getting-started.md +++ b//resource-explorer/latest/userguide/getting-started.md @@ -5 +5,3 @@ -Accessing Resource Explorer +Accessing Resource ExplorerImmediate accessEnhanced setup + +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) @@ -9 +11 @@ Accessing Resource Explorer -Use the topics in this section to get a basic understanding of the concepts and terms used by AWS Resource Explorer. Learn about the prerequisites that you must satisfy to successfully use Resource Explorer and how to turn on Resource Explorer in your AWS account. +Use the topics in this section to get a basic understanding of the concepts and terms used by AWS Resource Explorer. Learn how Resource Explorer is automatically enabled based on your permissions and how to access enhanced features for your AWS account. @@ -12,0 +15,11 @@ Use the topics in this section to get a basic understanding of the concepts and +Resource Explorer is automatically enabled when you access the service through any of the following methods, with your experience determined by your IAM permissions: + + * **Full Experience:** Users with, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy and the `iam:CreateServiceLinkedRole` permission (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy) get complete search results with automatic infrastructure creation on a Regional basis for indexes and views. + + * **Enhanced Experience:** Users with only the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy get immediate access to partial results (all tagged resources and supported untagged resources created after the [immediate resource discovery](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) release). + + * **No Access:** Users without the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy receive access denied errors, respecting IAM boundaries. + + + + @@ -18 +31 @@ You can interact with Resource Explorer in the following ways: -Resource Explorer provides a web-based user interface, the Resource Explorer console. If you signed up for an AWS account, you can access the Resource Explorer console by signing into the [AWS Management Console](https://console.aws.amazon.com/) and choosing **Resource Explorer** from the console home page. +Resource Explorer provides a web-based user interface, the Resource Explorer console. Simply navigating to or accessing the Resource Explorer console automatically triggers the setup process based on your permissions. You can access the Resource Explorer console by signing into the [AWS Management Console](https://console.aws.amazon.com/) and searching for it by name or choosing **View all services** and selecting **Resource Explorer** from the list. @@ -20 +33 @@ Resource Explorer provides a web-based user interface, the Resource Explorer con -You can also navigate in your browser directly to the **[Resource Explorer dashboard](https://console.aws.amazon.com/resource-explorer/home#/home)** page, or to the **[Resource search](https://console.aws.amazon.com/resource-explorer/home#/search)** page. If you aren't already signed in, then you're asked to do so before the console appears. +You can also navigate in your browser directly to the **[Resource Explorer home page](https://console.aws.amazon.com/resource-explorer/home#/home)** , or to the **[Resource search](https://console.aws.amazon.com/resource-explorer/home#/search)** page. If you aren't already signed in, then you're asked to do so before the console appears. @@ -26 +39 @@ The Resource Explorer console is a _global_ console, meaning that you don't have -**AWS Management Console unified search** +**AWS Management Console[Unified Search](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/using-search.html)** @@ -29 +42 @@ The Resource Explorer console is a _global_ console, meaning that you don't have -At the top of every page in the AWS Management Console, there is a search bar. You can [configure Resource Explorer to participate in unified search](./manage-service-unified-search.html). Then, your users can use [Resource Explorer search query syntax](./using-search-query-syntax.html) in the unified search text box, and see matching resources in those search results. By turning this feature on, users can search for resources from the console of any AWS service without having to first switch to the Resource Explorer console. +At the top of every page in the AWS Management Console, there is a search bar. Resource Explorer returns resource search results in Unified Search when you have the appropriate permissions. You can use [Resource Explorer search query syntax](./using-search-query-syntax.html) in the Unified Search text box, and see matching resources in those search results. You can search for resources from the console of any AWS service without having to first switch to the Resource Explorer console. @@ -33 +46 @@ At the top of every page in the AWS Management Console, there is a search bar. Y -Unified search always searches using the [default view](./getting-started-terms-and-concepts.html#term-view) in the AWS Region that contains the [aggregator index](./getting-started-terms-and-concepts.html#term-index). +Unified Search uses the default view in the aggregator Region if configured, or the default view in the current Region for regional results. @@ -38 +51 @@ Unified search always searches using the [default view](./getting-started-terms- -The AWS CLI and Tools for PowerShell provide direct access to the Resource Explorer public API operations. These tools work on Windows, macOS, and Linux. For more information about getting started, see the [AWS Command Line Interface User Guide](https://docs.aws.amazon.com/cli/latest/userguide/), or the [AWS Tools for Windows PowerShell User Guide](https://docs.aws.amazon.com/powershell/latest/userguide/). For more information about the commands for Resource Explorer, see the [AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/resource-explorer-2) or the [AWS Tools for Windows PowerShell Cmdlet Reference](https://docs.aws.amazon.com/powershell/latest/reference/index.html?page=ResourceExplorer2_cmdlets.html). +The AWS CLI and Tools for PowerShell provide direct access to the Resource Explorer public API operations and automatically trigger setup based on your permissions when you invoke search operations. These tools work on Windows, macOS, and Linux. For more information about getting started, see the [AWS Command Line Interface User Guide](https://docs.aws.amazon.com/cli/latest/userguide/), or the [AWS Tools for Windows PowerShell User Guide](https://docs.aws.amazon.com/powershell/latest/userguide/). For more information about the commands for Resource Explorer, see the [AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/resource-explorer-2) or the [AWS Tools for Windows PowerShell Cmdlet Reference](https://docs.aws.amazon.com/powershell/latest/reference/index.html?page=ResourceExplorer2_cmdlets.html). @@ -43 +56 @@ The AWS CLI and Tools for PowerShell provide direct access to the Resource Explo -AWS provides API commands for a broad set of programming languages. For more information about getting started, see [Using AWS Resource Explorer with an AWS SDK](./sdk-general-information-section.html). +AWS provides API commands for a broad set of programming languages that automatically enable Resource Explorer functionality when you have appropriate permissions. For more information about getting started, see [Using AWS Resource Explorer with an AWS SDK](./sdk-general-information-section.html). @@ -49,0 +63,36 @@ If you don't use one of the supported programming languages, the Resource Explor +## Getting started immediately + +You can start using Resource Explorer immediately with just the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy. This provides instant access to search functionality with partial results while automatic setup completes in the background. + +###### Note + +Automatic setup can complete only if you have the necessary permissions. You must have, at minimum, the permissions in the `[AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html)` managed policy. + +###### To start searching immediately + + 1. Ensure you have, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy. This permission is included in the `ResourceExplorerFullAccess` managed policy. + + 2. Navigate to the Resource Explorer console or use [Unified Search](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/using-search.html) from any AWS console page. + + 3. Begin searching immediately. You'll receive partial results (all tagged resources and supported untagged resources created after the [immediate resource discovery](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) release) while indexing completes. + + 4. (Optional) For complete results, obtain the `iam:CreateServiceLinkedRole` permission (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy). Once any user in your account creates the service-linked role, all users with search permission searching in a new Region can create an index and a view for full results. + + + + +## Enhanced setup for cross-Region search + +While Resource Explorer provides immediate regional search functionality, you can optionally configure enhanced features like cross-Region search and custom views. + + * **Cross-Region search:** Create an aggregator index to search across all Regions from a single location. + + * **Custom views:** Create filtered views for specific resource types or access control requirements. + + * **Multi-account search:** Configure organization-wide resource discovery (requires management account or delegated administrator permissions). + + + + +For detailed setup instructions, see [Setting up and configuring Resource Explorer](./getting-started-setting-up.html). +