AWS frauddetector high security documentation change

Service: frauddetector · 2025-10-10 · Security-related high

File: frauddetector/latest/ug/confused-deputy-prevention.md

Summary

Updated IAM role trust policy example to restrict resource access and added deprecation notice

Security assessment

Modified IAM policy example from permissive wildcard ('*') to specific 'external-model' resource restriction using aws:SourceArn condition. This addresses potential confused deputy vulnerabilities by implementing least privilege access control.

Diff

diff --git a/frauddetector/latest/ug/confused-deputy-prevention.md b/frauddetector/latest/ug/confused-deputy-prevention.md
index 93451737b..26169db14 100644
--- a//frauddetector/latest/ug/confused-deputy-prevention.md
+++ b//frauddetector/latest/ug/confused-deputy-prevention.md
@@ -4,0 +5,2 @@
+Amazon Fraud Detector will no longer be open to new customers starting November 7, 2025. If you would like to use Amazon Fraud Detector, sign up prior to that date. For capabilities similar to Amazon Fraud Detector, explore Amazon SageMaker, AutoGluon, and AWS WAF.
+
@@ -20,0 +23 @@ The following role trust policy example uses wildcard(*) in the `aws:SourceArn`
+The following role trust policy allows Amazon Fraud Detector access to only `external-model` resource. Notice the `aws:SourceArn` param in Condition block. The resource qualifier is built using the model endpoint that is provided for making the `PutExternalModel` API call. 
@@ -22,22 +25,4 @@ The following role trust policy example uses wildcard(*) in the `aws:SourceArn`
-    {
-            "Version": "2012-10-17",
-            "Statement": [
-                 {
-                   "Effect": "Allow",
-                   "Principal": {
-                   "Service": [
-                       "frauddetector.amazonaws.com"
-                       ]                
-                   },
-                   "Action": "sts:AssumeRole",
-                   "Condition": {
-                   "StringEquals": {
-                       "aws:SourceAccount": "123456789012"
-                   },
-                     "StringLike": {
-                        "aws:SourceArn": "arn:aws:frauddetector:us-west-2:123456789012:*"
-            }
-          }
-        }
-      ]
-    }
+JSON
+    
+
+****
@@ -45 +29,0 @@ The following role trust policy example uses wildcard(*) in the `aws:SourceArn`
-The following role trust policy allows Amazon Fraud Detector access to only `external-model` resource. Notice the `aws:SourceArn` param in Condition block. The resource qualifier is built using the model endpoint that is provided for making the `PutExternalModel` API call.