AWS resource-explorer documentation change
Summary
Updated terminology from 'local index' to 'user-owned (local) index', clarified cross-region search behavior, added details about automatic index creation permissions, and updated diagrams/descriptions
Security assessment
The changes clarify IAM permission requirements for automatic index creation (specifically mentioning AWSResourceExplorerReadOnlyAccess and iam:CreateServiceLinkedRole). While this adds security-related documentation about required permissions, there is no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/resource-explorer/latest/userguide/manage-aggregator-region.md b/resource-explorer/latest/userguide/manage-aggregator-region.md index ed0e6d7dd..9af843cf8 100644 --- a//resource-explorer/latest/userguide/manage-aggregator-region.md +++ b//resource-explorer/latest/userguide/manage-aggregator-region.md @@ -7 +7,3 @@ About the aggregator index -# Turning on cross-Region search by creating an aggregator index +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) + +# Enabling cross-Region search by creating an aggregator index @@ -24 +26,3 @@ With cross-region search enabled, you can search for resources across all of the -AWS Resource Explorer stores the information it collects about the resources in an AWS Region to a _local index_ that Resource Explorer creates and maintains in that Region. For example, assume that you have an Amazon EC2 instance in the US West (Oregon) Region. Resource Explorer stores the details about that resource in the local index in the US West (Oregon) Region. +AWS Resource Explorer stores the information it collects about the resources in an AWS Region to a _user-owned (local) index_ that Resource Explorer creates and maintains in that Region. For example, assume that you have an Amazon EC2 instance in the US West (Oregon) Region. Resource Explorer stores the details about that resource in the user-owned (local) index in the US West (Oregon) Region. + +To support searching for resources across all AWS Regions in your account, you can convert the user-owned (local) index in _one_ Region to be the aggregator index for your account. @@ -26 +30 @@ AWS Resource Explorer stores the information it collects about the resources in -To support searching for resources across all AWS Regions in your account, you can convert the local index in _one_ Region to be the aggregator index for your account. +Resource Explorer automatically creates user-owned indexes when users with appropriate permissions perform search operations in a Region. This automatic creation occurs when users have both, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy and the `iam:CreateServiceLinkedRole` permission, or when the service-linked role already exists in the account and users have search permissions. @@ -28 +32 @@ To support searching for resources across all AWS Regions in your account, you c -The aggregator index contains a replicated copy of the local index in every other Region where you turned on Resource Explorer. This lets you create views in the Region that contains the aggregator index whose results can include resources from all AWS Regions in the account. +The aggregator index contains a replicated copy of the user-owned (local) index in every other Region where you have a user-owned index for Resource Explorer. This lets you create views in the Region that contains the aggregator index whose results can include resources from all AWS Regions in the account. @@ -32 +36 @@ The following diagram shows an example of how the aggregator index works. In thi - * Turns on Resource Explorer in three AWS Regions (`us-east-1`, `us-west-2`, and `eu-west-1`) by creating indexes in those Regions. Each Region contains its own local index. + * Completes setup of Resource Explorer in three AWS Regions (`us-east-1`, `us-west-2`, and `eu-west-1`) by searching in or directly creating indexes in those Regions. Each Region contains its own user-owned (local) index. @@ -34 +38 @@ The following diagram shows an example of how the aggregator index works. In thi - * Chooses _not_ to create an index in the `sa-east-1` Region. Users can't perform searches in `sa-east-1`, and no resources from that Region appear in any search results. + * Does not create a user-owned index in the `sa-east-1` Region. Resources from `sa-east-1` will not appear in cross-region search results from other Regions. @@ -36 +40 @@ The following diagram shows an example of how the aggregator index works. In thi - * Creates the aggregator index for the account in the `us-west-2` Region. This causes Resource Explorer to replicate information from the local indexes in all other Regions where Resource Explorer is turned on to the aggregator index. This allows searches performed in `us-west-2` to include resources from all three Regions in which Resource Explorer is turned on. + * Creates the aggregator index for the account in the `us-west-2` Region. This causes Resource Explorer to replicate information from the user-owned (local) indexes in all other Regions where Resource Explorer where a user-owned (local) index exists. This allows searches performed in `us-west-2` to include resources from all three Regions in which Resource Explorer setup is complete. @@ -43 +47 @@ This configuration means that a user can perform cross-Region searches in **_onl - + @@ -47,3 +51,3 @@ This configuration means that a user can perform cross-Region searches in **_onl - | Resource Explorer is turned on in this AWS Region, and its resources are catalogued into an index in that Region. This Region's index is also replicated (indicated by the arrows) to the AWS Region that contains the aggregator index. - | This AWS Region contains the aggregator index. Resource Explorer replicates the resource information collected in all other AWS Regions into this Region. - | The default view created by **Quick Setup** includes all resources in all AWS Regions. + | Resource Explorer is set up with a user-owned (local) index in this AWS Region. Information about the Region's resources is stored in a local index in that Region. Every Region's user-owned (local) index is also replicated (indicated by the arrows) to the Region that contains the aggregator index. + | The index in this AWS Region is configured to be the aggregator index for the account. Resource Explorer replicates the resource information collected in the user-owned (local) indexes of all other Regions into the aggregator index in this Region. Searches made in this Region can include results from all Regions with user-owned (local) indexes in the account. + | The default view created by **Quick Setup** includes all resources in all AWS Regions with user-owned (local) indexes.