AWS AmazonS3 documentation change
Summary
Restructured documentation into numbered steps, added notes about S3 Batch Replication IAM requirements, clarified cross-account replication permissions, and updated replica ownership configuration guidance
Security assessment
The changes primarily improve documentation structure and clarify IAM permission requirements for replication scenarios. While they emphasize security best practices (like proper IAM role configuration and cross-account permissions), there is no explicit mention of addressing a specific security vulnerability or incident. The added Batch Replication note helps users implement secure configurations but doesn't indicate a security flaw was fixed.
Diff
diff --git a/AmazonS3/latest/userguide/setting-repl-config-perm-overview.md b/AmazonS3/latest/userguide/setting-repl-config-perm-overview.md index f521409e0..871a500f2 100644 --- a//AmazonS3/latest/userguide/setting-repl-config-perm-overview.md +++ b//AmazonS3/latest/userguide/setting-repl-config-perm-overview.md @@ -5 +5 @@ -Setting up permissions to create replication rulesCreating an IAM roleGranting permissions when the source and destination buckets are owned by different AWS accountsChanging replica ownershipGranting permissions for S3 Batch Operations +Step 1: Granting permissions to the IAM principal who's creating replication rulesStep 2: Creating an IAM role for Amazon S3 to assume(Optional) Step 3: Granting permissions when the source and destination buckets are owned by different AWS accounts(Optional) Step 4: Granting permissions to change replica ownership @@ -11 +11,3 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * Amazon S3 needs permissions to replicate objects on your behalf. You grant these permissions by creating an AWS Identity and Access Management (IAM) role and then specifying that role in your replication configuration. + * You must grant the AWS Identity and Access Management (IAM) principal (user or role) who will be creating replication rules a certain set of permissions. + + * Amazon S3 needs permissions to replicate objects on your behalf. You grant these permissions by creating an IAM role and then specifying that role in your replication configuration. @@ -18 +20 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe -###### Topics +###### Note @@ -20 +22,3 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * Setting up permissions to create replication rules +If you're using S3 Batch Operations to replicate objects on demand instead of setting up live replication, a different IAM role and policies are required for S3 Batch Replication. For a Batch Replication IAM role and policy examples, see [Configuring an IAM role for S3 Batch Replication](./s3-batch-replication-policies.html). + +###### Topics @@ -22 +26 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * Creating an IAM role + * Step 1: Granting permissions to the IAM principal who's creating replication rules @@ -24 +28 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * Granting permissions when the source and destination buckets are owned by different AWS accounts + * Step 2: Creating an IAM role for Amazon S3 to assume @@ -26 +30 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * Changing replica ownership + * (Optional) Step 3: Granting permissions when the source and destination buckets are owned by different AWS accounts @@ -28 +32 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * Granting permissions for S3 Batch Operations + * (Optional) Step 4: Granting permissions to change replica ownership @@ -33 +37 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe -## Setting up permissions to create replication rules +## Step 1: Granting permissions to the IAM principal who's creating replication rules @@ -146 +150 @@ JSON -## Creating an IAM role +## Step 2: Creating an IAM role for Amazon S3 to assume @@ -151,0 +156,4 @@ This section explains the trust policy and the minimum required permissions poli +###### Note + +If you're using the console to create your replication configuration, we recommend that you skip this section and instead have the console create this IAM role and the necessary trust and permission policies for you. + @@ -281 +289 @@ The permissions described here are related to the minimum replication configurat -## Granting permissions when the source and destination buckets are owned by different AWS accounts +## (Optional) Step 3: Granting permissions when the source and destination buckets are owned by different AWS accounts @@ -335 +343 @@ If objects in the source bucket are tagged, note the following: - * If the source bucket owner grants Amazon S3 permission for the `s3:GetObjectVersionTagging` and `s3:ReplicateTags` actions to replicate object tags (through the IAM role), Amazon S3 replicates the tags along with the objects. For information about the IAM role, see Creating an IAM role. + * If the source bucket owner grants Amazon S3 permission for the `s3:GetObjectVersionTagging` and `s3:ReplicateTags` actions to replicate object tags (through the IAM role), Amazon S3 replicates the tags along with the objects. For information about the IAM role, see Step 2: Creating an IAM role for Amazon S3 to assume. @@ -389,18 +397 @@ Follow the prompts and enter the AWS account ID of the source bucket account, an -## Changing replica ownership - -When different AWS accounts own the source and destination buckets, you can tell Amazon S3 to change the ownership of the replica to the AWS account that owns the destination bucket. For more information about owner override, see [Changing the replica owner](./replication-change-owner.html). - -## Granting permissions for S3 Batch Operations - -S3 Batch Replication provides you a way to replicate the following objects: - - * Objects that existed before a replication configuration was in place - - * Objects that have previously been replicated - - * Objects that have failed replication - - - - -You can create a one-time Batch Replication job when creating the first rule in a new replication configuration or when adding a new destination to an existing configuration through the Amazon S3 console. You can also initiate Batch Replication for an existing replication configuration by creating a Batch Operations job. +## (Optional) Step 4: Granting permissions to change replica ownership @@ -408 +399 @@ You can create a one-time Batch Replication job when creating the first rule in -For a Batch Replication IAM role and policy examples, see [Configuring an IAM role for S3 Batch Replication](./s3-batch-replication-policies.html). +When different AWS accounts own the source and destination buckets, you can tell Amazon S3 to change the ownership of the replica to the AWS account that owns the destination bucket. To override the ownership of replicas, you must either grant some additional permissions or adjust the S3 Object Ownership settings for the destination bucket. For more information about owner override, see [Changing the replica owner](./replication-change-owner.html).