AWS AWSEC2 medium security documentation change
Summary
Updated permissions requirements, CLI commands, and added service-linked role creation steps for organizational access
Security assessment
Removes delegated administrator from organizational access requirements and mandates service-linked role creation with specific policies. This tightens access control by centralizing management account responsibility and enforcing role-based permissions, directly impacting security configuration.
Diff
diff --git a/AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md b/AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md index 3a9d76a48..a65cfefb8 100644 --- a//AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md +++ b//AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md @@ -11 +11 @@ You can enable EC2 Capacity Manager with AWS Organizations for organization-leve -The management account or a delegated administrator account is responsible for enabling organization-level access and managing capacity across the organization. +The management account is responsible for enabling organization-level access and managing capacity across the organization. @@ -30 +30 @@ If you don't enable integration with AWS Organizations, you can only monitor res - * The management account or delegated administrator must have permissions for the following IAM actions: + * The management account must have permissions for the following IAM actions: @@ -37,0 +38,2 @@ If you don't enable integration with AWS Organizations, you can only monitor res + * You must create a service-linked role with the **AWSEC2CapacityManagerServiceRolePolicy** use case to allow AWS Organization access. For more information, see [Creating a service-linked role for Capacity Manager](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-service-linked-roles-cm.html#create-slr). + @@ -43 +45 @@ If you don't enable integration with AWS Organizations, you can only monitor res -Using either the management account or the delegated administrator account, enable organization access in Capacity Manager. +Using the management account, enable organization access in Capacity Manager. @@ -68 +70,14 @@ AWS CLI -Run the following command: + 1. Create a service-linked role + + aws iam create-service-linked-role --aws-service-name ec2.capacitymanager.amazonaws.com + + + 2. Enable AWS Organization access + + aws organizations enable-aws-service-access --service-principal ec2.capacitymanager.amazonaws.com + + + 3. Enable Capacity Manager with AWS Organization + + aws ec2 enable-capacity-manager --organizations-access + @@ -71 +85,0 @@ Run the following command: - aws ec2 enable-capacity-manager --enable-organizations-access @@ -74 +88 @@ Run the following command: -To update an existing Capacity Manager to enable organization access, run the following command: +To update organization access for an existing Capacity Manager, run the following command: @@ -77 +91 @@ To update an existing Capacity Manager to enable organization access, run the fo - aws ec2 update-capacity-manager --enable-organizations-access + aws ec2 update-capacity-manager-organizations-access --organizations-access @@ -104 +118 @@ Run the following command: - aws ec2 list-capacity-manager-attributes + aws ec2 get-capacity-manager-attributes @@ -111,4 +125,4 @@ The output should display: - "enabled": true, - "orgs-access": true, - "home-region": "us-east-1", - "organization-id": "o-xxxxxxxxxx" + "CapacityManagerStatus": "enabled", + "OrganizationsAccess": true, + "IngestionStatus": "initial-ingestion-pending", + "IngestionStatusMessage": "Capacity Manager is collecting historical data from 2025-10-01T00:00:00Z. Data collection is in progress and may take several hours to complete." @@ -120 +134 @@ The output should display: - * **Service-linked role creation:** When you enable organization access, Capacity Manager automatically creates the AWSServiceRoleForCapacityManager service-linked role in all member accounts. This role allows Capacity Manager to discover and monitor resources across your organization. + * **Service-linked role creation:** When you enable organization access through the console, Capacity Manager automatically creates the AWSServiceRoleForCapacityManager service-linked role in all member accounts. If you enable through the AWS CLI, you must call `createServiceLinkedRole` manually.