AWS resource-explorer documentation change
Summary
Updated documentation to reflect automatic search capability activation based on IAM permissions, clarified differences between partial/complete search results based on roles, and added details about service-managed views and indexing behavior.
Security assessment
The changes emphasize IAM permission requirements (AWSResourceExplorerReadOnlyAccess and iam:CreateServiceLinkedRole) governing access to complete resource inventory. While this clarifies security controls, there's no evidence of addressing a specific vulnerability. The documentation update focuses on explaining security-related access mechanisms rather than fixing a security issue.
Diff
diff --git a/resource-explorer/latest/userguide/using-search.md b/resource-explorer/latest/userguide/using-search.md index d89edc1cb..2e677a6f5 100644 --- a//resource-explorer/latest/userguide/using-search.md +++ b//resource-explorer/latest/userguide/using-search.md @@ -6,0 +7,2 @@ Quick filters +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) + @@ -9 +11,3 @@ Quick filters -The primary purpose of enabling AWS Resource Explorer in your AWS account is to allow your users to search for resources in the account, and to use the Resource Explorer console to quickly act on those resources. You can use the AWS Management Console or the AWS Command Line Interface (AWS CLI) to search for resources using Resource Explorer. +AWS Resource Explorer provides immediate search capabilities for your AWS resources without requiring manual setup. When you access Resource Explorer with the appropriate permissions, the service automatically enables resource search functionality in your account. You can use the AWS Management Console or the AWS Command Line Interface (AWS CLI) to search for resources using Resource Explorer. + +The search experience you receive depends on your IAM permissions. With basic search permissions, you get immediate access to partial results while indexing completes in the background. With additional permissions, you receive complete resource inventory and enhanced functionality. @@ -12,0 +17,4 @@ The following are some of the main characteristics of Resource Explorer search. + * **Resource Explorer automatically enables search functionality based on your permissions.** + +When you access Resource Explorer with the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy, the service automatically provides search capabilities. Users with both the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy and the `iam:CreateServiceLinkedRole` permission (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy) receive complete resource inventory. The `iam:CreateServiceLinkedRole` permission (included in the [AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html) managed policy) is only needed until the first user creates the service-linked role for the account. Once created, subsequent users with only the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy in Regions where Resource Explorer has been set up will also receive complete results. Users without the service-linked role receive partial results immediately (all tagged resources plus untagged resources created after the feature launch). + @@ -19 +27,3 @@ The view can include a filter that limits which resources can be included in the -For more information about views, see [Configuring an Resource Explorer view to provide access to resource searches](./configure-views.html). +Resource Explorer provides both user-owned views (which you create and manage) and Resource Explorer-owned views (which are service-managed and cannot be modified or deleted). Resource Explorer-owned views do not include resource tags in search results. If no user-owned view is available, Resource Explorer automatically falls back to using a Resource Explorer-owned view to ensure search functionality remains available. + +For more information about views, see [Configuring a Resource Explorer view to provide access to resource searches](./customer-views.html#configure-views). @@ -27 +37,5 @@ The same applies to resources that you delete. It can take some time after you d -Most resource modifications and deletions are visible in search results within minutes in all Regions where you’ve activated Resource Explorer. In some cases, modifications or deletions may take up to two weeks to be visible. +Most resource modifications and deletions are visible in search results within minutes in all Regions where you’ve completed setup for Resource Explorer. In some cases, modifications or deletions may take up to two weeks to be visible. + + * **Search results may be partial during initial indexing.** + +During the initial indexing process after automatic setup, you may see partial results while the complete resource inventory is being built. Users with appropriate permissions will see indexing progress indicators in the console, and results will become more complete as indexing progresses. @@ -31 +45 @@ Most resource modifications and deletions are visible in search results within m -Each Region where you turn on Resource Explorer contains an index of only the resources stored in that Region. Views are also associated with Regions, and can return only the resources found in that Region's index. The one exception to this is the aggregator index, that receives a replicated copy of all of the local indexes to support searching across all Regions in the account. +Each Region where you complete setup for Resource Explorer contains an index of only the resources stored in that Region. Views are also associated with Regions, and can return only the resources found in that Region's index. The one exception to this is the aggregator index, that receives a replicated copy of all of the local indexes to support searching across all Regions in the account.