AWS Security ChangesHomeSearch

AWS AWSEC2 medium security documentation change

Service: AWSEC2 · 2025-10-19 · Security-related medium

File: AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md

Summary

Updated permissions requirements, CLI commands, and added service-linked role creation steps for organizational access

Security assessment

Removes delegated administrator from organizational access requirements and mandates service-linked role creation with specific policies. This tightens access control by centralizing management account responsibility and enforcing role-based permissions, directly impacting security configuration.

Diff

diff --git a/AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md b/AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md
index 3a9d76a48..a65cfefb8 100644
--- a//AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md
+++ b//AWSEC2/latest/UserGuide/enable-capacity-manager-organizations.md
@@ -11 +11 @@ You can enable EC2 Capacity Manager with AWS Organizations for organization-leve
-The management account or a delegated administrator account is responsible for enabling organization-level access and managing capacity across the organization.
+The management account is responsible for enabling organization-level access and managing capacity across the organization.
@@ -30 +30 @@ If you don't enable integration with AWS Organizations, you can only monitor res
-  * The management account or delegated administrator must have permissions for the following IAM actions:
+  * The management account must have permissions for the following IAM actions:
@@ -37,0 +38,2 @@ If you don't enable integration with AWS Organizations, you can only monitor res
+  * You must create a service-linked role with the **AWSEC2CapacityManagerServiceRolePolicy** use case to allow AWS Organization access. For more information, see [Creating a service-linked role for Capacity Manager](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-service-linked-roles-cm.html#create-slr).
+
@@ -43 +45 @@ If you don't enable integration with AWS Organizations, you can only monitor res
-Using either the management account or the delegated administrator account, enable organization access in Capacity Manager.
+Using the management account, enable organization access in Capacity Manager.
@@ -68 +70,14 @@ AWS CLI
-Run the following command:
+  1. Create a service-linked role
+    
+        aws iam create-service-linked-role --aws-service-name ec2.capacitymanager.amazonaws.com
+                          
+
+  2. Enable AWS Organization access
+    
+        aws organizations enable-aws-service-access --service-principal ec2.capacitymanager.amazonaws.com
+                          
+
+  3. Enable Capacity Manager with AWS Organization 
+    
+        aws ec2 enable-capacity-manager --organizations-access
+                          
@@ -71 +85,0 @@ Run the following command:
-    aws ec2 enable-capacity-manager --enable-organizations-access
@@ -74 +88 @@ Run the following command:
-To update an existing Capacity Manager to enable organization access, run the following command:
+To update organization access for an existing Capacity Manager, run the following command:
@@ -77 +91 @@ To update an existing Capacity Manager to enable organization access, run the fo
-    aws ec2 update-capacity-manager --enable-organizations-access
+    aws ec2 update-capacity-manager-organizations-access --organizations-access
@@ -104 +118 @@ Run the following command:
-    aws ec2 list-capacity-manager-attributes
+    aws ec2 get-capacity-manager-attributes
@@ -111,4 +125,4 @@ The output should display:
-        "enabled": true,
-        "orgs-access": true,
-        "home-region": "us-east-1",
-        "organization-id": "o-xxxxxxxxxx"
+        "CapacityManagerStatus": "enabled",
+        "OrganizationsAccess": true,
+        "IngestionStatus": "initial-ingestion-pending",
+        "IngestionStatusMessage": "Capacity Manager is collecting historical data from 2025-10-01T00:00:00Z. Data collection is in progress and may take several hours to complete."
@@ -120 +134 @@ The output should display:
-  * **Service-linked role creation:** When you enable organization access, Capacity Manager automatically creates the AWSServiceRoleForCapacityManager service-linked role in all member accounts. This role allows Capacity Manager to discover and monitor resources across your organization.
+  * **Service-linked role creation:** When you enable organization access through the console, Capacity Manager automatically creates the AWSServiceRoleForCapacityManager service-linked role in all member accounts. If you enable through the AWS CLI, you must call `createServiceLinkedRole` manually.