AWS frauddetector high security documentation change

Service: frauddetector · 2025-10-10 · Security-related high

File: frauddetector/latest/ug/security_iam_id-based-policy-examples.md

Summary

Added service deprecation notice, modified IAM policy examples by replacing detailed JSON with placeholders, and restructured policy explanation sections

Security assessment

The change replaces specific read-only IAM actions with a wildcard (*) permission in policy examples, which could lead to over-permissive policies if followed. This demonstrates a security-relevant documentation error in recommending excessive privileges. The removal of resource-specific deny examples also reduces guidance on least-privilege principles.

Diff

diff --git a/frauddetector/latest/ug/security_iam_id-based-policy-examples.md b/frauddetector/latest/ug/security_iam_id-based-policy-examples.md
index 445602664..cd626837a 100644
--- a//frauddetector/latest/ug/security_iam_id-based-policy-examples.md
+++ b//frauddetector/latest/ug/security_iam_id-based-policy-examples.md
@@ -6,0 +7,2 @@ Policy best practicesManaged policyAllow users to view their own permissionsAllo
+Amazon Fraud Detector will no longer be open to new customers starting November 7, 2025. If you would like to use Amazon Fraud Detector, sign up prior to that date. For capabilities similar to Amazon Fraud Detector, explore Amazon SageMaker, AutoGluon, and AWS WAF.
+
@@ -117,0 +120 @@ The following example gives an user in your AWS account full access to all Amazo
+JSON
@@ -119,12 +121,0 @@ The following example gives an user in your AWS account full access to all Amazo
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "frauddetector:*"
-                ],
-                "Resource": "*"
-            }
-        ]
-    }
@@ -131,0 +123 @@ The following example gives an user in your AWS account full access to all Amazo
+****
@@ -133,3 +124,0 @@ The following example gives an user in your AWS account full access to all Amazo
-## Allow read-only access to Amazon Fraud Detector resources
-
-In this example, you grant an user in your AWS account read-only access to your Amazon Fraud Detector resources.
@@ -144,18 +133 @@ In this example, you grant an user in your AWS account read-only access to your
-                    "frauddetector:GetEventTypes",
-                    "frauddetector:BatchGetVariable",
-                    "frauddetector:DescribeDetector",
-                    "frauddetector:GetModelVersion",
-                    "frauddetector:GetEventPrediction",
-                    "frauddetector:GetExternalModels",
-                    "frauddetector:GetLabels",
-                    "frauddetector:GetVariables",
-                    "frauddetector:GetDetectors",
-                    "frauddetector:GetRules",
-                    "frauddetector:ListTagsForResource",
-                    "frauddetector:GetKMSEncryptionKey",
-                    "frauddetector:DescribeModelVersions",
-                    "frauddetector:GetDetectorVersion",
-                    "frauddetector:GetPrediction",
-                    "frauddetector:GetOutcomes",
-                    "frauddetector:GetEntityTypes",
-                    "frauddetector:GetModels"
+                    "frauddetector:*"
@@ -169 +140,0 @@ In this example, you grant an user in your AWS account read-only access to your
-## Allow access to a specific resource
@@ -171 +142 @@ In this example, you grant an user in your AWS account read-only access to your
-In this example of a resource-level policy, you grant an user in your AWS account access to all actions and resources except for one particular Detector resource.
+## Allow read-only access to Amazon Fraud Detector resources
@@ -172,0 +144 @@ In this example of a resource-level policy, you grant an user in your AWS accoun
+In this example, you grant an user in your AWS account read-only access to your Amazon Fraud Detector resources.
@@ -174,19 +146 @@ In this example of a resource-level policy, you grant an user in your AWS accoun
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "frauddetector:*"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Effect": "Deny",
-                "Action": [
-                    "frauddetector:*Detector"
-                ],
-                "Resource": "arn:${Partition}:frauddetector:${Region}:${Account}:detector/${detector-name}"
-            }
-        ]
-    }
+## Allow access to a specific resource
@@ -193,0 +148 @@ In this example of a resource-level policy, you grant an user in your AWS accoun
+In this example of a resource-level policy, you grant an user in your AWS account access to all actions and resources except for one particular Detector resource.
@@ -204,0 +160,6 @@ The following example policy allows users to access all of Amazon Fraud Detector
+JSON
+    
+
+****
+    
+    
@@ -269,0 +232,6 @@ The following is an example of a policy that denies specific actions on any Amaz
+JSON
+    
+
+****
+    
+