AWS proton medium security documentation change

Service: proton · 2025-10-10 · Security-related medium

File: proton/latest/userguide/security_iam_service-role-policy-examples.md

Summary

Added end of support notice, corrected ARN format (added 'proton' region separator), and removed/reformatted JSON policy examples

Security assessment

The ARN format correction from 'arn:aws::proton' to 'arn:aws:proton:*:123456789012:environment/*' fixes a potential misconfiguration in IAM policies that could have led to failed policy enforcement. This addresses a security-adjacent configuration issue but does not directly document a security feature.

Diff

diff --git a/proton/latest/userguide/security_iam_service-role-policy-examples.md b/proton/latest/userguide/security_iam_service-role-policy-examples.md
index 13f525551..da84bcad0 100644
--- a//proton/latest/userguide/security_iam_service-role-policy-examples.md
+++ b//proton/latest/userguide/security_iam_service-role-policy-examples.md
@@ -6,0 +7,2 @@ AWS-managed provisioning roleCodeBuild provisioning rolePipeline service rolesCo
+End of support notice: On October 7, 2026, AWS will end support for AWS Proton. After October 7, 2026, you will no longer be able to access the AWS Proton console or AWS Proton resources. Your deployed infrastructure will remain intact. For more information, see [AWS Proton Service Deprecation and Migration Guide](https://docs.aws.amazon.com/proton/latest/userguide/proton-end-of-support.html).
+
@@ -26,0 +29,6 @@ Replace ``123456789012`` with your AWS account ID.
+JSON
+    
+
+****
+    
+    
@@ -86,0 +95,7 @@ Replace ``123456789012`` with your AWS account ID.
+JSON
+    
+
+****
+    
+    
+    
@@ -101 +116 @@ Replace ``123456789012`` with your AWS account ID.
-            "aws:SourceArn": "arn:aws::proton:*:123456789012:environment/*"
+            "aws:SourceArn": "arn:aws:proton:*:123456789012:environment/*"
@@ -108,0 +125,6 @@ The following is an example of a scoped down AWS Proton service role policy that
+JSON
+    
+
+****
+    
+    
@@ -165,0 +189,6 @@ Replace ``123456789012`` with your AWS account ID.
+JSON
+    
+
+****
+    
+    
@@ -198,0 +228,7 @@ Replace ``123456789012`` with your AWS account ID.
+JSON
+    
+
+****
+    
+    
+    
@@ -213 +249 @@ Replace ``123456789012`` with your AWS account ID.
-            "aws:SourceArn": "arn:aws::proton:*:123456789012:environment/*"
+            "aws:SourceArn": "arn:aws:proton:*:123456789012:environment/*"
@@ -236,0 +274,4 @@ Replace ``123456789012`` with your AWS account ID.
+JSON
+    
+
+****
@@ -238,45 +278,0 @@ Replace ``123456789012`` with your AWS account ID.
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": [
-            "cloudformation:CancelUpdateStack",
-            "cloudformation:CreateChangeSet",
-            "cloudformation:DeleteChangeSet",
-            "cloudformation:DescribeStacks",
-            "cloudformation:ContinueUpdateRollback",
-            "cloudformation:DetectStackResourceDrift",
-            "cloudformation:DescribeStackResourceDrifts",
-            "cloudformation:DescribeStackEvents",
-            "cloudformation:CreateStack",
-            "cloudformation:DeleteStack",
-            "cloudformation:UpdateStack",
-            "cloudformation:DescribeChangeSet",
-            "cloudformation:ExecuteChangeSet",
-            "cloudformation:ListChangeSets",
-            "cloudformation:ListStackResources"
-          ],
-          "Resource": "arn:aws:cloudformation:*:123456789012:stack/AWSProton-*"
-        },
-        {
-          "Effect": "Allow",
-          "Action": [
-            "s3:CreateBucket",
-            "s3:DeleteBucket",
-            "s3:GetBucket",
-            "iam:CreatePolicy",
-            "iam:DeletePolicy",
-            "iam:GetPolicy",
-            "iam:ListPolicyVersions",
-            "iam:DeletePolicyVersion"
-          ],
-          "Resource": "*",
-          "Condition": {
-            "ForAnyValue:StringEquals": {
-              "aws:CalledVia": "cloudformation.amazonaws.com"
-            }
-          }
-        }
-      ]
-    }
@@ -299 +295 @@ Replace ``123456789012`` with your AWS account ID.
-            "aws:SourceArn": "arn:aws::proton:*:123456789012:environment/*"
+            "aws:SourceArn": "arn:aws:proton:*:123456789012:environment/*"