AWS AmazonRDS documentation change
Summary
Restructured and consolidated access control documentation for Performance Insights, adding tag-based access control guidance and reorganizing policy attachment methods
Security assessment
The changes reorganize security-related documentation about IAM policies and KMS permissions but don't address a specific vulnerability. Added emphasis on KMS permissions ('kms:Decrypt' and 'kms:GenerateDataKey') reinforces existing security practices but doesn't indicate a resolved issue. New tag-based access control documentation expands security feature coverage.
Diff
diff --git a/AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.md b/AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.md index 68ceb3fff..8d66ab233 100644 --- a//AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.md +++ b//AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.md @@ -5,2 +4,0 @@ -Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principalAttaching the AmazonRDSPerformanceInsightsFullAccess policy to an IAM principal - @@ -9,24 +7 @@ Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principalAtt -To access Performance Insights, a principal must have the appropriate permissions from AWS Identity and Access Management (IAM). You can grant access in the following ways: - - * Attach the `AmazonRDSPerformanceInsightsReadOnly` managed policy to a permission set or role to access all read-only operations of the Performance Insights API. Attach the following CloudWatch permssions: `GetMetricStatistics`, `ListMetrics`, and `GetMetricData`. For more information about CloudWatch permissions, see [Amazon CloudWatch permissions reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/permissions-reference-cw.html). - - * Attach the `AmazonRDSPerformanceInsightsFullAccess` managed policy to a permission set or role to access all operations of the Performance Insights API. Attach the following CloudWatch permssions: `GetMetricStatistics`, `ListMetrics`, and `GetMetricData`. For more information about CloudWatch permissions, see [Amazon CloudWatch permissions reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/permissions-reference-cw.html). - - * Create a custom IAM policy and attach it to a permission set or role. - - - - -If you specified a customer managed key when you turned on Performance Insights, make sure that users in your account have the `kms:Decrypt` and `kms:GenerateDataKey` permissions on the AWS KMS key. - -In the following sections, attach an AWS managed policy to an IAM principal, create a custom IAM policy, change an AWS KMS policy, and grant fine-grained access for Performance Insights. - -###### Topics - - * Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principal - - * Attaching the AmazonRDSPerformanceInsightsFullAccess policy to an IAM principal - - * [Creating a custom IAM policy for Performance Insights](./USER_PerfInsights.access-control.custom-policy.html) - - * [Changing an AWS KMS policy for Performance Insights](./USER_PerfInsights.access-control.cmk-policy.html) +To access Performance Insights, a principal must have the appropriate permissions from AWS Identity and Access Management (IAM). @@ -34 +9 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre - * [Granting fine-grained access for Performance Insights](./USER_PerfInsights.access-control.dimensionAccess-policy.html) +###### Note @@ -35,0 +11 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre +To use Performance Insights with a customer-managed key, grant users the `kms:Decrypt` and `kms:GenerateDataKey` permissions for your AWS AWS KMS key. @@ -36,0 +13 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre +Access Performance Insights using these methods: @@ -37,0 +15 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre + * [Attach the AmazonRDSPerformanceInsightsReadOnly managed policy for read-only access](./USER_PerfInsights.access-control.managed-policy.html) @@ -39 +17 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre -## Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principal + * [Attach the AmazonRDSPerformanceInsightsFullAccess managed policy for access to all operations of the Performance Insights API](./USER_PerfInsights.access-control.FullAccess-managed-policy.html) @@ -41 +19 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre -`AmazonRDSPerformanceInsightsReadOnly` is an AWS managed policy that grants access to all read-only operations of the Amazon RDS Performance Insights API. + * [Create a custom IAM policy with specific permissions](./USER_PerfInsights.access-control.custom-policy.html) @@ -43 +21 @@ In the following sections, attach an AWS managed policy to an IAM principal, cre -If you attach `AmazonRDSPerformanceInsightsReadOnly` to a permission set or role, the recipient can use Performance Insights with other console features. + * [Configure AWS KMS permissions for encrypted Performance Insights data](./USER_PerfInsights.access-control.cmk-policy.html) @@ -45 +23 @@ If you attach `AmazonRDSPerformanceInsightsReadOnly` to a permission set or role -For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadOnly](./rds-security-iam-awsmanpol.html#rds-security-iam-awsmanpol-AmazonRDSPerformanceInsightsReadOnly). + * [Set up fine-grained access using resource-level permissions](./USER_PerfInsights.access-control.dimensionAccess-policy.html) @@ -47 +25 @@ For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadO -## Attaching the AmazonRDSPerformanceInsightsFullAccess policy to an IAM principal + * [Use tag-based access control to manage permissions through resource tags](./USER_PerfInsights.access-control.tag-based-policy.html) @@ -49 +26,0 @@ For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadO -`AmazonRDSPerformanceInsightsFullAccess` is an AWS managed policy that grants access to all operations of the Amazon RDS Performance Insights API. @@ -51 +27,0 @@ For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsReadO -If you attach `AmazonRDSPerformanceInsightsFullAccess` to a permission set or role, the recipient can use Performance Insights with other console features. @@ -53 +28,0 @@ If you attach `AmazonRDSPerformanceInsightsFullAccess` to a permission set or ro -For more information, see [AWS managed policy: AmazonRDSPerformanceInsightsFullAccess](./rds-security-iam-awsmanpol.html#rds-security-iam-awsmanpol-AmazonRDSPerformanceInsightsFullAccess). @@ -63 +38 @@ Turn on the Performance Schema for Amazon RDS for MariaDB or MySQL -Creating a custom IAM policy for Performance Insights +Attaching the AmazonRDSPerformanceInsightsReadOnly policy to an IAM principal