AWS resource-explorer documentation change
Summary
Updated documentation to reflect immediate resource discovery availability, differentiate between full/partial search results based on index types (user-owned vs Resource Explorer-owned), and clarify required permissions for result completeness
Security assessment
The changes emphasize required permissions (AWSResourceExplorerReadOnlyAccess) for accessing search results and clarify security implications of index types. While this documents security controls, there's no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/resource-explorer/latest/userguide/manage-service-check.md b/resource-explorer/latest/userguide/manage-service-check.md index 9a7708d7d..11525eb1b 100644 --- a//resource-explorer/latest/userguide/manage-service-check.md +++ b//resource-explorer/latest/userguide/manage-service-check.md @@ -5 +5,14 @@ -Checking the Resource Explorer status in a Region +Checking index types and result completeness in Regions + +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) + +# Identifying which Regions display full versus partial resource results + +AWS Resource Explorer provides different levels of search results depending on your permissions and the type of index in each Region. All Regions have Resource Explorer-owned indexes that provide partial results (all tagged resources and supported untagged resources created after the [immediate resource discovery](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) release. Accessing partial results requires that you have, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy). Regions with user-owned indexes provide complete search results. You can identify which type of results you'll receive in each Region by checking the index types using the procedures on this page. + +The search results you receive depend on both your permissions and the index type: + + * **Full results:** Available in Regions with user-owned indexes when you have, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy (and the service-linked role exists in the account) + + * **Partial results:** Available in all Regions through Resource Explorer-owned indexes when you have, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy, or in Regions where user-owned indexes have been deleted + @@ -7 +19,0 @@ Checking the Resource Explorer status in a Region -# Identify which AWS Regions have Resource Explorer turned on @@ -9 +20,0 @@ Checking the Resource Explorer status in a Region -You can identify which AWS Regions have AWS Resource Explorer turned on by verifying if the Region contain an index for Resource Explorer. To view which Regions have an index, use the procedures on this page. @@ -13 +24 @@ You can identify which AWS Regions have AWS Resource Explorer turned on by verif -Users can search for resources in _only_ those Regions that have Resource Explorer turned on. You can also create an aggregator index in one Region to support searching for resources in all of your Regions. Resource Explorer replicates resource information to the Region with the aggregator index from all other Regions that contain a Resource Explorer index. Users can't use Resource Explorer to discover resources in Regions that don't have an index. +Users can search for resources in all Regions, but the completeness of results varies by index type. Regions with user-owned indexes provide complete search results and replicate to the aggregator index for cross-Region search (when enabled). Regions with only Resource Explorer-owned indexes provide partial results (all tagged resources and supported untagged resources created after the [immediate resource discovery](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) release) but are not included in cross-Region search replication. @@ -15 +26 @@ Users can search for resources in _only_ those Regions that have Resource Explor -## Checking the Resource Explorer status in a Region +## Checking index types and result completeness in Regions @@ -17 +28 @@ Users can search for resources in _only_ those Regions that have Resource Explor -You can check which Regions have indexes for Resource Explorer by using the AWS Management Console, by using commands in the AWS Command Line Interface (AWS CLI), or by using API operations in an AWS SDK. +You can check which Regions have user-owned indexes (providing full results) versus Resource Explorer-owned indexes (providing partial results) by using the AWS Management Console, by using commands in the AWS Command Line Interface (AWS CLI), or by using API operations in an AWS SDK. All Regions have Resource Explorer-owned indexes by default, while user-owned indexes are created when users with appropriate permissions complete setup in a Region. @@ -22 +33 @@ AWS Management Console -###### To check which Regions have indexes for Resource Explorer +###### To check index types and result completeness by Region @@ -26 +37 @@ AWS Management Console - 2. The list in the **Indexes** section includes only those Regions that contain a Resource Explorer index. The value in the **Type** column indicates whether the index is a **Local** index for its Region, or the **Aggregator** index for the AWS account. + 2. The list in the **Indexes** section shows user-owned indexes that provide complete search results. The value in the **Type** column indicates whether the index is a **Local** index for its Region, or the **Aggregator** index for the AWS account. Regions not listed have only Resource Explorer-owned indexes, which provide partial results. @@ -28 +39 @@ AWS Management Console - 3. To see which Regions don't contain a Resource Explorer, choose **Create indexes**. If a Region is not present, then the Region does not contain Resource Explorer. + 3. To see which Regions have only Resource Explorer-owned indexes (partial results), choose **Create indexes**. Available Regions in this list have only Resource Explorer-owned indexes and will provide partial search results until you create user-owned indexes for full results. @@ -36 +47 @@ AWS CLI -###### To check which Regions have indexes for Resource Explorer +###### To check index types and result completeness by Region @@ -38 +49 @@ AWS CLI -Run the following command to see which AWS Regions have indexes for Resource Explorer. +Run the following command to see which AWS Regions have user-owned indexes (providing complete results). Regions not listed have only Resource Explorer-owned indexes (providing partial results). @@ -63 +74 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Setting up Resource Explorer +Immediate resource discovery experience @@ -65 +76 @@ Setting up Resource Explorer -Turning on a Region +Completing setup