AWS resource-explorer low security documentation change
Summary
Updated documentation to reflect automatic enablement of Resource Explorer, new indexing structure, IAM permission requirements, and enhanced search capabilities. Added details about immediate resource discovery, cross-Region search setup, and simplified first-time user experience.
Security assessment
The changes explicitly detail IAM permission requirements (AWSResourceExplorerReadOnlyAccess/AWSResourceExplorerFullAccess) and service-linked role creation (iam:CreateServiceLinkedRole) for secure access control. It clarifies that search visibility depends on IAM permissions and mentions CloudTrail event monitoring integration. These updates address security posture by enforcing least-privilege access and audit capabilities.
Diff
diff --git a/resource-explorer/latest/userguide/welcome.md b/resource-explorer/latest/userguide/welcome.md index edbf69cd4..35f422400 100644 --- a//resource-explorer/latest/userguide/welcome.md +++ b//resource-explorer/latest/userguide/welcome.md @@ -5 +5,3 @@ -First time userFeatures of Resource ExplorerSupported RegionsRelated servicesPricing +First-time userFeatures of Resource ExplorerSupported RegionsRelated servicesPricing + +AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) @@ -11 +13,5 @@ AWS Resource Explorer is a resource search and discovery service. With Resource -Resource Explorer provides fast responses to your search queries by using indexes that are created and maintained by the AWS Resource Explorer service. Resource Explorer uses a variety of data sources to gather information about resources in your AWS account. Resource Explorer stores that information in the indexes for Resource Explorer to search. +AWS Resource Explorer provides fast responses to your search queries by using indexes that are created and maintained by the AWS Resource Explorer service. These indexes come in two types: Resource Explorer-owned indexes that provide immediate partial results, and user-owned indexes that provide complete results with automatic updates. Resource Explorer uses a variety of data sources to gather information about resources in your AWS account. Resource Explorer stores that information in the indexes for Resource Explorer to search. + +Beginning October 6, 2025, Resource Explorer is enabled by default in your AWS account with no setup steps required to begin searching for and finding resources. When you first access Resource Explorer through the AWS Management Console, [Unified Search](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/using-search.html), or CLI/SDK/API, you'll automatically receive search functionality based on your IAM permissions, as explained later in this page under Are you a first-time Resource Explorer user?. Resource Explorer provides immediate search results in each AWS Region you access, with Unified Search showing results from your current AWS Region without requiring any additional configuration. + +For enhanced functionality, you can search across multiple AWS Regions by enabling cross-Region search with a single click or API call to select an aggregator AWS Region. Organizations can set up multi-account search by enabling trusted access and using AWS CloudFormation deployment. If you previously configured Resource Explorer with cross-Region search, your existing setup remains unchanged. You can now search for resources across hundreds of AWS services, such as Amazon Elastic Compute Cloud instances, Amazon Kinesis streams, Amazon DynamoDB tables, and more, without any initial configuration, making it easier to manage resources and troubleshoot issues from the moment you access your account. @@ -34 +40,7 @@ Our goal is to help you get everything you can from Resource Explorer. If this g -If you're a first-time user of Resource Explorer, we recommend that you begin by reading the following topics in the _Getting started_ section: +As a first-time user of Resource Explorer, you can start searching for resources immediately without any setup steps. You can access Resource Explorer through the AWS Management Console, Unified Search, or CLI/SDK/API to begin finding your resources. + +Your search experience is automatically enabled based on your IAM permissions. If you have, at minimum, the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy, you can immediately search in partial results (all tagged resources and supported untagged resources created after the [immediate resource discovery](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) release). Resource Explorer uses a service-linked channel to receive AWS CloudTrail events on your behalf, and this visibility will be available in the CloudTrail console by end of October 2025 across all supported Regions. For complete resource inventory with automatic updates, you'll also need the `iam:CreateServiceLinkedRole` permission (included in the `[AWSResourceExplorerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerFullAccess.html)` managed policy). After the service-linked role is created in your account by any user, subsequent users only need the permissions in the `[AWSResourceExplorerReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceExplorerReadOnlyAccess.html)` managed policy to get complete results on first search in subsequent Regions. + +To get the most from Resource Explorer, we recommend starting with search and then exploring these topics as needed: + + * [Using AWS Resource Explorer to search for resources](./using-search.html) @@ -38 +50 @@ If you're a first-time user of Resource Explorer, we recommend that you begin by - * [Setting up Resource Explorer using Quick setup ](./getting-started-setting-up.html#getting-started-setting-up-quick) + * [Setting up and configuring Resource Explorer](./getting-started-setting-up.html) @@ -47 +59,7 @@ Resource Explorer provides the following features: - * Users can **_search for resources_** in their AWS Region or across Regions in their AWS account. + * Automatic features (available immediately): + + * Resource Explorer is automatically enabled when you first access the service or search in Unified Search, providing immediate search functionality. Depending on your IAM permissions, you can view either partial results immediately or complete resource inventory with automatic updates. + + * Users can search for resources in their current AWS Region through the Resource Explorer console, Unified Search, or CLI/SDK/API. + + * Users can use keywords, search operators, and attributes like tags to filter the search results to only matching resources. @@ -49 +67 @@ Resource Explorer provides the following features: - * Users can use keywords, search operators, and attributes like tags to** _filter the search results to only matching resources_**. + * When users find a resource in the search results, they can immediately go to the resource's native console to work with that resource. @@ -51 +69 @@ Resource Explorer provides the following features: - * When users find a resource in the search results, they can immediately **_go to the resource's native console_** to work with that resource. + * Enhanced features (optional configuration): @@ -53 +71 @@ Resource Explorer provides the following features: - * Users can view additional information about a selected resource from other AWS services, such as AWS Config and AWS Cloud Control, directly in the Resource Explorer console. + * Cross-Region search capability when you select an aggregator AWS Region. @@ -55 +73 @@ Resource Explorer provides the following features: - * Users can manage their resources using quick Actions in the Resource Explorer console to manage tags and add resources to new or existing applications. + * Multi-account search through AWS Organizations integration. @@ -57 +75 @@ Resource Explorer provides the following features: - * Administrators can **_create views that define which resources are available in search results_**. Administrators can create different views for different groups of users based on their tasks, and grant permissions to views to only those users who need them. + * Additional resource details from other AWS services, such as AWS Config and AWS Cloud Control, directly in the Resource Explorer console. @@ -59 +77,15 @@ Resource Explorer provides the following features: - * Resource Explorer, like many other AWS services, is ** _[eventually consistent](https://wikipedia.org/wiki/Eventual_consistency)_**. Resource Explorer achieves high availability by replicating data across multiple servers within Amazon data centers around the world. If a request to change some data is successful, the change is committed and safely stored. However, then the change must be replicated across Resource Explorer, which can take some time. As an example, this includes Resource Explorer finding a resource in one Region, and replicating that to the Region that contains the aggregator index for the account. + * Resource management using quick Actions in the Resource Explorer console to manage tags and add resources to new or existing applications. + + * Custom views that administrators can create to define which resources are available in search results, with different views for different user groups based on their needs. + +Manual configuration is only needed in specific cases: + + * When you need to add missing permissions + + * When you want enhanced features like cross-Region search + + * When you want to set up multi-account configurations + + * When you want to customize your Resource Explorer setup + + * Resource Explorer, like many other AWS services, is _[eventually consistent](https://wikipedia.org/wiki/Eventual_consistency)_. Resource Explorer achieves high availability by replicating data across multiple servers within Amazon data centers around the world. If a request to change some data is successful, the change is committed and safely stored. However, then the change must be replicated across Resource Explorer, which can take some time. As an example, this includes Resource Explorer finding a resource in one AWS Region, and replicating that to the AWS Region that contains the aggregator index for the account. @@ -65,0 +98,2 @@ Resource Explorer provides the following features: +The following table provides information about the AWS Regions where Resource Explorer is available. + @@ -127 +161,3 @@ Tags are customer-defined metadata that you can attach to your resources. You ca -There are no charges to search for resources by using AWS Resource Explorer, including creating views, turning on Regions, or searching for resources. In the process of building your resource inventory, Resource Explorer calls APIs on your behalf that may result in charges. Interacting with the resources that you find in your search results can result in usage charges that vary depending on the resource type and its AWS service. Some sources of additional data available in the Resource Explorer console are from other AWS services that can result in usage charges, such as AWS Config. These sources are only used if you explicitly enable them in your account. For more information about how AWS bills for the normal use of a specific resource type, refer to the documentation for that resource type's owning service. +Automatic setup and basic search functionality are available at no additional cost. There are no charges to search for resources by using AWS Resource Explorer, including creating views, completing setup in AWS Regions, or searching for resources. + +In the process of building your resource inventory, Resource Explorer calls APIs on your behalf that may result in charges. Interacting with the resources that you find in your search results can result in usage charges that vary depending on the resource type and its AWS service. Some sources of additional data available in the Resource Explorer console are from other AWS services that can result in usage charges, such as AWS Config. These sources are only used if you explicitly enable them in your account. For more information about how AWS bills for the normal use of a specific resource type, refer to the documentation for that resource type's owning service.