AWS resource-explorer documentation change
Summary
Updated documentation to reflect automatic resource discovery capabilities, simplified setup workflows, and clarified service-linked role creation triggers. Added guidance for manual setup scenarios and enhanced console workflows.
Security assessment
The changes primarily focus on service functionality improvements rather than addressing security vulnerabilities. While they mention service-linked roles and permissions requirements, this is part of normal operational documentation rather than responding to a specific security issue. The update to automatic role creation upon first user access with permissions improves clarity about security controls but doesn't indicate a security fix.
Diff
diff --git a/resource-explorer/latest/userguide/manage-service-turn-on-region.md b/resource-explorer/latest/userguide/manage-service-turn-on-region.md index 680363147..c1cdadc89 100644 --- a//resource-explorer/latest/userguide/manage-service-turn-on-region.md +++ b//resource-explorer/latest/userguide/manage-service-turn-on-region.md @@ -7 +7 @@ Create a Resource Explorer index in a Region -# Turning on Resource Explorer in an AWS Region to index your resources +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) @@ -9 +9,3 @@ Create a Resource Explorer index in a Region -When you initially turn on AWS Resource Explorer in your AWS account, you created indexes for the service in one or more AWS Regions. If you used the **[Quick setup](./getting-started-setting-up.html#getting-started-setting-up-quick)** option, Resource Explorer automatically created indexes in all [AWS Regions that are turned on in your AWS account](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html). The Resource Explorer service also promoted the index in the specified Region to be the [aggregator index](./manage-aggregator-region.html) for the account. If you used the **[Advanced setup](./getting-started-setting-up.html#getting-started-setting-up-advanced)** option, you specified the Regions in which to create indexes. +# Completing setup for Resource Explorer + +AWS Resource Explorer automatically enables basic search functionality when you search with appropriate permissions. However, you may need to manually complete setup in specific scenarios, such as when you lack required permissions, have previously deleted an index in a Region, or need to manage existing aggregator configurations. For enhanced functionality like cross-Region search, you can use the **[Quick setup](./getting-started-setting-up.html#getting-started-setting-up-quick)** option or one-click cross-Region banner to create indexes in all [AWS Regions that are turned on in your AWS account](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html). When you use the Quick Setup option, Resource Explorer promotes the specified Region to be the [aggregator index](./manage-aggregator-region.html) for the account. If you use the **[Advanced setup](./getting-started-setting-up.html#getting-started-setting-up-advanced)** option, you can specify the Regions in which to create indexes. @@ -20 +22 @@ When you initially turn on AWS Resource Explorer in your AWS account, you create -When you turn on Resource Explorer in an AWS Region, the service performs the following actions: +When you complete setup for Resource Explorer in an AWS Region, the service performs the following actions: @@ -22 +24 @@ When you turn on Resource Explorer in an AWS Region, the service performs the fo - * When you start Resource Explorer in the **_first_** Region in an AWS account, Resource Explorer creates a [service-linked role in the account named AWSServiceRoleForResourceExplorer](./security_iam_service-linked-roles.html). This role grants permissions for Resource Explorer to discover and index the resources in your account by using services such as AWS CloudTrail and the tagging service. Creation of the service-linked role happens only when you register the **_first_** AWS Region in the account. Resource Explorer uses the same service-linked role for all additional Regions that you add later. + * When the first user with appropriate permissions accesses Resource Explorer in the first Region in an AWS account, Resource Explorer automatically creates a [service-linked role in the account named AWSServiceRoleForResourceExplorer](./security_iam_service-linked-roles.html). This role grants permissions for Resource Explorer to discover and index the resources in your account by using services such as AWS CloudTrail and the tagging service. Resource Explorer uses a service-linked channel to receive CloudTrail events on your behalf. Creation of the service-linked role happens only when you register the first AWS Region in the account. Resource Explorer uses the same service-linked role for all additional Regions that you add later. @@ -24 +26 @@ When you turn on Resource Explorer in an AWS Region, the service performs the fo - * Resource Explorer creates an index in the specified Region to store the details about that Region's resources. + * Resource Explorer automatically creates an index in the specified Region to store the details about that Region's resources. Once the service-linked role exists in the account, subsequent Regions are automatically enabled when users with search permissions invoke search operations in those Regions. @@ -33 +35 @@ When you turn on Resource Explorer in an AWS Region, the service performs the fo -When those steps are complete, information about your resources is available to be discovered by users. They can search by using one of the [views](./configure-views.html) defined in either the same Region or the Region that contains the aggregator index. +When those steps are complete, information about your resources is available to be discovered by users. They can search by using one of the [views](./customer-views.html#configure-views) defined in either the same Region or the Region that contains the aggregator index. @@ -36,0 +39,17 @@ When those steps are complete, information about your resources is available to +While Resource Explorer automatically enables basic search functionality, you may need to manually create indexes in specific scenarios. The Resource Explorer console provides banner notifications to guide you through setup completion, and you can access enhanced setup options through the "Complete Setup" option in the left navigation or on the **Settings** page. + +Manual index creation is typically needed when: + + * You lack the required `iam:CreateServiceLinkedRole` permission for automatic setup + + * You previously deleted an index in a Region and want to restore full functionality + + * You need to manage existing aggregator configurations or create cross-Region search capabilities + + * You want enhanced control over index configuration and tagging + + + + +During manual setup, you may see indexing progress indicators in the console. A blue banner displays "Completing AWS Resource Explorer setup" while indexing is in progress, which changes to a green completion banner when setup is finished. + @@ -54,0 +74,10 @@ AWS Management Console + 1. **Primary method - Banner workflow:** If you see a **Complete setup and enable cross-Region search** banner, you can use these guided workflows: + + 1. For cross-Region setup, choose **Enable cross-Region search in all Regions** in the banner + +-or- + +For customized setup, choose **Customize Region setup** to access enhanced configuration options. + + 2. **Alternative method - Settings page:** If banner workflows are not available or you need manual control: + @@ -59 +88 @@ AWS Management Console - 3. On the **Create indexes** page, select the check boxes next to the AWS Regions in which you want to create an index to support searching that Region's resources. Unavailable check boxes indicate Regions that already contain a Resource Explorer index. + 3. On the **Create indexes** page, select the check boxes next to the AWS Regions in which you want to create an index to support searching that Region's resources. Unavailable check boxes indicate Regions that already contain a user-owned index. @@ -76 +105 @@ Tagged resources local to the index appear in search results within a few minute -However, if you want users to be able to search for resources in **_only_** the newly indexed Region, then you must also create a view for users in that Region and grant your users permissions to that view. For instructions on how to create a view, see [Configuring an Resource Explorer view to provide access to resource searches](./configure-views.html). +However, if you want users to be able to search for resources in **_only_** the newly indexed Region, then you can also create a view for users in that Region and grant your users permissions to that view or users can search using the service view in that Region.. For instructions on how to create a view, see [Configuring a Resource Explorer view to provide access to resource searches](./customer-views.html#configure-views). @@ -94 +123 @@ Run the following command for each AWS Region in which you want to create an ind -Repeat this command for each Region in which you want to turn on Resource Explorer, substituting the appropriate Region code for the `--region` parameter. +Repeat this command for each Region in which you want to complete setup for Resource Explorer, substituting the appropriate Region code for the `--region` parameter. @@ -119 +148 @@ You can check for final completion by running the following command, and checkin -However, if you want users to be able to search for resources in **_only_** the newly indexed Region, then you must also create a view for users in that Region and grant your users permissions to that view. For instructions on how to create a view, see [Configuring an Resource Explorer view to provide access to resource searches](./configure-views.html). +However, if you want users to be able to search for resources in **_only_** the newly indexed Region, then you can also create a view for users in that Region and grant your users permissions to that view or users can search using the service view in that Region. For instructions on how to create a view, see [Configuring a Resource Explorer view to provide access to resource searches](./customer-views.html#configure-views). @@ -127 +156 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Identify Resource Explorer status in AWS Regions +Full vs partial results by Region