AWS resource-explorer documentation change
Summary
Added note about immediate resource discovery, clarified IAM CreateServiceLinkedRole inclusion in AWSResourceExplorerFullAccess policy
Security assessment
Clarifies IAM policy configuration details which helps users properly configure security permissions, but does not address a specific security vulnerability. The change improves documentation of existing security controls.
Diff
diff --git a/resource-explorer/latest/userguide/security_iam_awsmanpol.md b/resource-explorer/latest/userguide/security_iam_awsmanpol.md index 81766e39a..77552cbf5 100644 --- a//resource-explorer/latest/userguide/security_iam_awsmanpol.md +++ b//resource-explorer/latest/userguide/security_iam_awsmanpol.md @@ -6,0 +7,2 @@ AWSResourceExplorerFullAccessAWSResourceExplorerReadOnlyAccessAWSResourceExplore +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) + @@ -59 +61 @@ This policy includes permissions that allow all actions for Resource Explorer, i - * `iam:CreateServiceLinkedRole` – allows Resource Explorer to create the required service-linked role when you [turn on Resource Explorer by creating the first index](./manage-service-turn-on-region.html#manage-service-turn-on-region-region). + * `iam:CreateServiceLinkedRole` (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy) – allows Resource Explorer to create the required service-linked role when you [turn on Resource Explorer by creating the first index](./manage-service-turn-on-region.html#manage-service-turn-on-region-region). @@ -139 +141 @@ This policy includes permissions that allow administrators to set up multi-accou - * `iam:CreateServiceLinkedRole` – Allows Resource Explorer to create the required service-linked role when you [turn on Resource Explorer by creating the first index](./manage-service-turn-on-region.html#manage-service-turn-on-region-region). + * `iam:CreateServiceLinkedRole` (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy) – Allows Resource Explorer to create the required service-linked role when you [turn on Resource Explorer by creating the first index](./manage-service-turn-on-region.html#manage-service-turn-on-region-region).