AWS wellarchitected documentation change
Summary
Removed specific condition about IAM roles feasibility when discussing Secrets Manager/Parameter Store usage
Security assessment
Clarifies usage of secrets management services without changing security posture. Focuses on existing security features (secret rotation, secure parameter storage) but does not address a specific vulnerability.
Diff
diff --git a/wellarchitected/latest/framework/sec_permissions_define.md b/wellarchitected/latest/framework/sec_permissions_define.md index 33f62290a..570fecf23 100644 --- a//wellarchitected/latest/framework/sec_permissions_define.md +++ b//wellarchitected/latest/framework/sec_permissions_define.md @@ -32 +32 @@ When defining access requirements for non-human identities, determine which appl -AWS services, such as [AWS Secrets Manager](https://aws.amazon.com/blogs/security/identify-arrange-manage-secrets-easily-using-enhanced-search-in-aws-secrets-manager/) and [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html), can help decouple secrets from the application or workload securely in cases where it's not feasible to use IAM roles. In Secrets Manager, you can establish automatic rotation for your credentials. You can use Systems Manager to reference parameters in your scripts, commands, SSM documents, configuration, and automation workflows by using the unique name that you specified when you created the parameter. +AWS services, such as [AWS Secrets Manager](https://aws.amazon.com/blogs/security/identify-arrange-manage-secrets-easily-using-enhanced-search-in-aws-secrets-manager/) and [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html), can help decouple secrets from the application or workload securely. In Secrets Manager, you can establish automatic rotation for your credentials. You can use Systems Manager to reference parameters in your scripts, commands, SSM documents, configuration, and automation workflows by using the unique name that you specified when you created the parameter.