AWS proton low security documentation change
Summary
Added end-of-support notice for AWS Proton, corrected ARN format in policy example, replaced inline IAM policy JSON with links to AWS managed policies, and adjusted document formatting.
Security assessment
The correction of the ARN format from 'arn:aws::proton:*' to 'arn:aws:proton:*' fixes a potential misconfiguration in IAM policies. An incorrect ARN could lead to policies not being applied correctly, potentially causing unintended access issues. This addresses a security-related configuration error.
Diff
diff --git a/proton/latest/userguide/security-iam-awsmanpol.md b/proton/latest/userguide/security-iam-awsmanpol.md index fd6c08fd1..baf36d299 100644 --- a//proton/latest/userguide/security-iam-awsmanpol.md +++ b//proton/latest/userguide/security-iam-awsmanpol.md @@ -6,0 +7,2 @@ AWSProtonFullAccessAWSProtonDeveloperAccessAWSProtonReadOnlyAccessAWSProtonSyncS +End of support notice: On October 7, 2026, AWS will end support for AWS Proton. After October 7, 2026, you will no longer be able to access the AWS Proton console or AWS Proton resources. Your deployed infrastructure will remain intact. For more information, see [AWS Proton Service Deprecation and Migration Guide](https://docs.aws.amazon.com/proton/latest/userguide/proton-end-of-support.html). + @@ -18,0 +21,6 @@ The following trust relationship is used for each of the AWS Proton managed poli +JSON + + +**** + + @@ -34 +42 @@ The following trust relationship is used for each of the AWS Proton managed poli - "aws:SourceArn": "arn:aws::proton:*:123456789012:environment/*" + "aws:SourceArn": "arn:aws:proton:*:123456789012:environment/*" @@ -59,88 +68 @@ The policy includes the following key action namespaces: -This policy includes the following permissions. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "ProtonPermissions", - "Effect": "Allow", - "Action": [ - "proton:*", - "codestar-connections:ListConnections", - "kms:ListAliases", - "kms:DescribeKey" - ], - "Resource": "*" - }, - { - "Sid": "CreateGrantPermissions", - "Effect": "Allow", - "Action": [ - "kms:CreateGrant" - ], - "Resource": "*", - "Condition": { - "StringLike": { - "kms:ViaService": "proton.*.amazonaws.com" - } - } - }, - { - "Sid": "PassRolePermissions", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "iam:PassedToService": "proton.amazonaws.com" - } - } - }, - { - "Sid": "CreateServiceLinkedRolePermissions", - "Effect": "Allow", - "Action": "iam:CreateServiceLinkedRole", - "Resource": "arn:aws:iam::*:role/aws-service-role/sync.proton.amazonaws.com/AWSServiceRoleForProtonSync", - "Condition": { - "StringEquals": { - "iam:AWSServiceName": "sync.proton.amazonaws.com" - } - } - }, - { - "Sid": "CodeStarConnectionsPermissions", - "Effect": "Allow", - "Action": [ - "codestar-connections:PassConnection" - ], - "Resource": [ - "arn:aws:codestar-connections:*:*:connection/*", - "arn:aws:codeconnections:*:*:connection/*" - ], - "Condition": { - "StringEquals": { - "codestar-connections:PassedToService": "proton.amazonaws.com" - } - } - }, - { - "Sid": "CodeConnectionsPermissions", - "Effect": "Allow", - "Action": [ - "codeconnections:PassConnection" - ], - "Resource": [ - "arn:aws:codestar-connections:*:*:connection/*", - "arn:aws:codeconnections:*:*:connection/*" - ], - "Condition": { - "StringEquals": { - "codeconnections:PassedToService": "proton.amazonaws.com" - } - } - } - ] - } +For more information, see [AWSProtonFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSProtonFullAccess.html). @@ -167,98 +89 @@ This policy includes the following permissions. - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "ProtonPermissions", - "Effect": "Allow", - "Action": [ - "codecommit:ListRepositories", - "codepipeline:GetPipeline", - "codepipeline:GetPipelineExecution", - "codepipeline:GetPipelineState", - "codepipeline:ListPipelineExecutions", - "codepipeline:ListPipelines", - "codestar-connections:ListConnections", - "codestar-connections:UseConnection", - "proton:CancelServiceInstanceDeployment", - "proton:CancelServicePipelineDeployment", - "proton:CreateService", - "proton:DeleteService", - "proton:GetAccountRoles", - "proton:GetAccountSettings", - "proton:GetEnvironment", - "proton:GetEnvironmentAccountConnection", - "proton:GetEnvironmentTemplate", - "proton:GetEnvironmentTemplateMajorVersion", - "proton:GetEnvironmentTemplateMinorVersion", - "proton:GetEnvironmentTemplateVersion", - "proton:GetRepository", - "proton:GetRepositorySyncStatus", - "proton:GetResourcesSummary", - "proton:GetService", - "proton:GetServiceInstance", - "proton:GetServiceTemplate", - "proton:GetServiceTemplateMajorVersion", - "proton:GetServiceTemplateMinorVersion", - "proton:GetServiceTemplateVersion", - "proton:GetTemplateSyncConfig", - "proton:GetTemplateSyncStatus", - "proton:ListEnvironmentAccountConnections", - "proton:ListEnvironmentOutputs", - "proton:ListEnvironmentProvisionedResources", - "proton:ListEnvironments", - "proton:ListEnvironmentTemplateMajorVersions", - "proton:ListEnvironmentTemplateMinorVersions", - "proton:ListEnvironmentTemplates", - "proton:ListEnvironmentTemplateVersions", - "proton:ListRepositories", - "proton:ListRepositorySyncDefinitions", - "proton:ListServiceInstanceOutputs", - "proton:ListServiceInstanceProvisionedResources", - "proton:ListServiceInstances", - "proton:ListServicePipelineOutputs", - "proton:ListServicePipelineProvisionedResources", - "proton:ListServices", - "proton:ListServiceTemplateMajorVersions", - "proton:ListServiceTemplateMinorVersions", - "proton:ListServiceTemplates", - "proton:ListServiceTemplateVersions", - "proton:ListTagsForResource", - "proton:UpdateService", - "proton:UpdateServiceInstance", - "proton:UpdateServicePipeline", - "s3:ListAllMyBuckets", - "s3:ListBucket" - ], - "Resource": "*" - }, - { - "Sid": "CodeStarConnectionsPermissions", - "Effect": "Allow", - "Action": "codestar-connections:PassConnection", - "Resource": [ - "arn:aws:codestar-connections:*:*:connection/*", - "arn:aws:codeconnections:*:*:connection/*" - ], - "Condition": { - "StringEquals": { - "codestar-connections:PassedToService": "proton.amazonaws.com" - } - } - }, - { - "Sid": "CodeConnectionsPermissions", - "Effect": "Allow", - "Action": "codeconnections:PassConnection", - "Resource": [ - "arn:aws:codestar-connections:*:*:connection/*", - "arn:aws:codeconnections:*:*:connection/*" - ], - "Condition": { - "StringEquals": {