AWS AmazonRDS documentation change
Summary
Restructured access control documentation for Performance Insights, consolidating policy attachment details into linked subpages and adding new sections for tag-based access control. Removed redundant explanations of managed policies and added clearer organization for KMS key requirements.
Security assessment
The changes reorganize existing security documentation about IAM policies and KMS permissions without indicating a specific vulnerability fix. The added tag-based access control section expands security documentation but doesn't address a known issue. Emphasis on KMS permissions reinforces existing security requirements but doesn't indicate a new threat.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/USER_PerfInsights.access-control.md b/AmazonRDS/latest/AuroraUserGuide/USER_PerfInsights.access-control.md index c53411c10..17ac68705 100644 --- a//AmazonRDS/latest/AuroraUserGuide/USER_PerfInsights.access-control.md +++ b//AmazonRDS/latest/AuroraUserGuide/USER_PerfInsights.access-control.md @@ -5,2 +4,0 @@ -Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principalAttaching the AmazonRDSPerformanceInsightsFullAccess policy to an IAM principal - @@ -9,24 +7 @@ Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principalAtt -To access Performance Insights, a principal must have the appropriate permissions from AWS Identity and Access Management (IAM). You can grant access in the following ways: - - * Attach the `AmazonRDSPerformanceInsightsReadOnly` managed policy to a permission set or role to access all read-only operations of the Performance Insights API. Attach the following CloudWatch permssions: `GetMetricStatistics`, `ListMetrics`, and `GetMetricData`. For more information about CloudWatch permissions, see [Amazon CloudWatch permissions reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/permissions-reference-cw.html). - - * Attach the `AmazonRDSPerformanceInsightsFullAccess` managed policy to a permission set or role to access all operations of the Performance Insights API. Attach the following CloudWatch permssions: `GetMetricStatistics`, `ListMetrics`, and `GetMetricData`. For more information about CloudWatch permissions, see [Amazon CloudWatch permissions reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/permissions-reference-cw.html). - - * Create a custom IAM policy and attach it to a permission set or role. - - - - -If you specified a customer managed key when you turned on Performance Insights, make sure that users in your account have the `kms:Decrypt` and `kms:GenerateDataKey` permissions on the AWS KMS key. - -In the following sections, attach an AWS managed policy to an IAM principal, create a custom IAM policy, change an AWS KMS policy, and grant fine-grained access for Performance Insights. - -###### Topics - - * Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principal - - * Attaching the AmazonRDSPerformanceInsightsFullAccess policy to an IAM principal - - * [Creating a custom IAM policy for Performance Insights](./USER_PerfInsights.access-control.custom-policy.html) - - * [Changing an AWS KMS policy for Performance Insights](./USER_PerfInsights.access-control.cmk-policy.html) +To access Performance Insights, a principal must have the appropriate permissions from AWS Identity and Access Management (IAM). @@ -34 +9 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre - * [Granting fine-grained access for Performance Insights](./USER_PerfInsights.access-control.dimensionAccess-policy.html) +###### Note @@ -35,0 +11 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre +To use Performance Insights with a customer-managed key, grant users the `kms:Decrypt` and `kms:GenerateDataKey` permissions for your AWS AWS KMS key. @@ -36,0 +13 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre +Access Performance Insights using these methods: @@ -37,0 +15 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre + * [Attach the AmazonRDSPerformanceInsightsReadOnly managed policy for read-only access](./USER_PerfInsights.access-control.managed-policy.html) @@ -39 +17 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre -## Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principal + * [Attach the AmazonRDSPerformanceInsightsFullAccess managed policy for access to all operations of the Performance Insights API](./USER_PerfInsights.access-control.FullAccess-managed-policy.html) @@ -41 +19 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre -`AmazonRDSPerformanceInsightsReadOnly` is an AWS managed policy that grants access to all read-only operations of the Amazon RDS Performance Insights API. + * [Create a custom IAM policy with specific permissions](./USER_PerfInsights.access-control.custom-policy.html) @@ -43 +21 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre -If you attach `AmazonRDSPerformanceInsightsReadOnly` to a permission set or role, the recipient can use Performance Insights with other console features. + * [Configure AWS KMS permissions for encrypted Performance Insights data](./USER_PerfInsights.access-control.cmk-policy.html) @@ -45 +23 @@ If you attach `AmazonRDSPerformanceInsightsReadOnly` to a permission set or role -For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadOnly](./rds-security-iam-awsmanpol.html#rds-security-iam-awsmanpol-AmazonRDSPerformanceInsightsReadOnly). + * [Set up fine-grained access using resource-level permissions](./USER_PerfInsights.access-control.dimensionAccess-policy.html) @@ -47 +25 @@ For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadO -## Attaching the AmazonRDSPerformanceInsightsFullAccess policy to an IAM principal + * [Use tag-based access control to manage permissions through resource tags](./USER_PerfInsights.access-control.tag-based-policy.html) @@ -49 +26,0 @@ For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadO -`AmazonRDSPerformanceInsightsFullAccess` is an AWS managed policy that grants access to all operations of the Amazon RDS Performance Insights API. @@ -51 +27,0 @@ For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadO -If you attach `AmazonRDSPerformanceInsightsFullAccess` to a permission set or role, the recipient can use Performance Insights with other console features. @@ -53 +28,0 @@ If you attach `AmazonRDSPerformanceInsightsFullAccess` to a permission set or ro -For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsFullAccess](./rds-security-iam-awsmanpol.html#rds-security-iam-awsmanpol-AmazonRDSPerformanceInsightsFullAccess). @@ -63 +38 @@ Turn on the Performance Schema for Aurora MySQL -Creating a custom IAM policy for Performance Insights +Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principal