AWS r53recovery documentation change
Summary
Restructured policy examples section by replacing inline JSON policies with links to dedicated documentation pages. Removed detailed policy examples and execution block implementations while adding new section links for cross-account permissions and CloudWatch alarms.
Security assessment
The changes reorganize existing security documentation about IAM policies for region switching without introducing new vulnerabilities or fixes. While the content relates to security permissions, there's no evidence of addressing a specific security flaw. The restructuring improves documentation clarity but doesn't fundamentally alter security guidance.
Diff
diff --git a/r53recovery/latest/dg/security_iam_id-based-policy-examples-region-switch.md b/r53recovery/latest/dg/security_iam_id-based-policy-examples-region-switch.md index 8c77b4e63..bae9c0f86 100644 --- a//r53recovery/latest/dg/security_iam_id-based-policy-examples-region-switch.md +++ b//r53recovery/latest/dg/security_iam_id-based-policy-examples-region-switch.md @@ -5 +5 @@ -Policy best practicesPlan execution role trust policyFull access permissionsRead-only permissionsExecution block permissionsCross-account resource accessComplete plan execution role policy +Policy best practices @@ -19 +19 @@ For details about actions and resource types defined by ARC, including the forma - * Plan execution role trust policy + * [Plan execution role trust policy](./security_iam_region_switch_trust_policy.html) @@ -21 +21 @@ For details about actions and resource types defined by ARC, including the forma - * Full access permissions + * [Full access permissions](./security_iam_region_switch_full_access.html) @@ -23 +23 @@ For details about actions and resource types defined by ARC, including the forma - * Read-only permissions + * [Read-only permissions](./security_iam_region_switch_read_only.html) @@ -25 +25 @@ For details about actions and resource types defined by ARC, including the forma - * Execution block permissions + * [Execution block permissions](./security_iam_region_switch_execution_blocks.html) @@ -27 +27 @@ For details about actions and resource types defined by ARC, including the forma - * Cross-account resource access + * [CloudWatch alarms for application health permissions](./security_iam_region_switch_cloudwatch.html) @@ -29 +29,3 @@ For details about actions and resource types defined by ARC, including the forma - * Complete plan execution role policy + * [Cross-account resource permissions](./security_iam_region_switch_cross_account.html) + + * [Complete plan execution role permissions](./security_iam_region_switch_complete_policy.html) @@ -53,480 +54,0 @@ For more information about best practices in IAM, see [Security best practices i -## Plan execution role trust policy - -This is the trust policy required for the plan's execution role: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "arc-region-switch.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - -## Full access permissions - -The following IAM policy grants full access for all Region switch APIs: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "iam:PassRole", - "Resource": "*", - "Condition": { - "StringEquals": { - "iam:PassedToService": "arc-region-switch.amazonaws.com" - } - } - }, - { - "Effect": "Allow", - "Action": [ - "arc-region-switch:CreatePlan", - "arc-region-switch:UpdatePlan", - "arc-region-switch:GetPlan", - "arc-region-switch:ListPlans", - "arc-region-switch:DeletePlan", - "arc-region-switch:GetPlanInRegion", - "arc-region-switch:ListPlansInRegion", - "arc-region-switch:ApprovePlanExecutionStep", - "arc-region-switch:GetPlanEvaluationStatus", - "arc-region-switch:GetPlanExecution", - "arc-region-switch:CancelPlanExecution", - "arc-region-switch:ListRoute53HealthChecks", - "arc-region-switch:ListPlanExecutions", - "arc-region-switch:ListPlanExecutionEvents", - "arc-region-switch:ListTagsForResource", - "arc-region-switch:TagResource", - "arc-region-switch:UntagResource", - "arc-region-switch:UpdatePlanExecution", - "arc-region-switch:UpdatePlanExecutionStep" - ], - "Resource": "*" - } - ] - } - -## Read-only permissions - -The following IAM policy grants read-only access permissions for Region switch: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "arc-region-switch:GetPlan", - "arc-region-switch:ListPlans", - "arc-region-switch:GetPlanInRegion", - "arc-region-switch:ListPlansInRegion", - "arc-region-switch:GetPlanEvaluationStatus", - "arc-region-switch:GetPlanExecution", - "arc-region-switch:ListRoute53HealthChecks", - "arc-region-switch:ListPlanExecutions", - "arc-region-switch:ListPlanExecutionEvents", - "arc-region-switch:ListTagsForResource" - ], - "Resource": "*" - } - ] - } - -## Execution block permissions - -The following sections provide IAM policies for specific execution blocks that you add to a Region switch plan. - -### EC2 Amazon EC2 Auto Scaling execution block - -Policy for the plan execution role to manage EC2 Amazon EC2 Auto Scaling groups: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAutoScalingGroups" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "autoscaling:UpdateAutoScalingGroup" - ], - "Resource": [ - "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:123d456e-123e-1111-abcd-EXAMPLE22222:autoScalingGroupName/app-asg-primary", - "arn:aws:autoscaling:us-west-2:123456789012:autoScalingGroup:1234a321-123e-1234-aabb-EXAMPLE33333:autoScalingGroupName/app-asg-secondary" - ] - }, - { - "Effect": "Allow", - "Action": [ - "cloudwatch:GetMetricStatistics" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": "AWS/AutoScaling" - } - } - } - ] - } - -### Amazon EKS resource scaling execution block - -Policy for the plan execution role to manage Amazon EKS clusters: - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "eks:DescribeCluster" - ], - "Resource": [ - "arn:aws:eks:us-east-1:123456789012:cluster/app-eks-primary", - "arn:aws:eks:us-west-2:123456789012:cluster/app-eks-secondary" - ] - }, - { - "Effect": "Allow", - "Action": [ - "eks:ListAssociatedAccessPolicies" - ], - "Resource": [ - "arn:aws:eks:us-east-1:123456789012:access-entry/app-eks-primary/*", - "arn:aws:eks:us-west-2:123456789012:access-entry/app-eks-secondary/*" - ] - } - ] - } - -Note: In addition to this IAM policy, the plan execution role needs to be added to the Amazon EKS cluster's access entries with the `AmazonArcRegionSwitchScalingPolicy` access policy. For more information, see [Configure EKS access entry permissions](./eks-resource-scaling-block.html#eks-resource-scaling-block-permissions). - -### Amazon ECS service scaling execution block - -Policy for the plan execution role to manage Amazon ECS services: -