AWS awscloudtrail documentation change
Summary
Updated CLI instructions to use policy files instead of inline JSON and adjusted workflow steps
Security assessment
Improves documentation clarity for applying resource policies but does not introduce new security features or address vulnerabilities. The policy content remains unchanged.
Diff
diff --git a/awscloudtrail/latest/userguide/lake-dashboard-cli-create.md b/awscloudtrail/latest/userguide/lake-dashboard-cli-create.md index 102f27344..6aceb6d30 100644 --- a//awscloudtrail/latest/userguide/lake-dashboard-cli-create.md +++ b//awscloudtrail/latest/userguide/lake-dashboard-cli-create.md @@ -102 +102 @@ In the this example, `?` is surrounded with single quotes because it is used wit - 2. Run the `put-resource-policy` command to attach a resource-based policy to each event data store that is included in a widget's `QueryStatement`. You can also update an event data store's resource-based policy on the CloudTrail console. For an example policy, see [Example: Allow CloudTrail to run queries to refresh a dashboard](./security_iam_resource-based-policy-examples.html#security_iam_resource-based-policy-examples-eds-dashboard). + 2. Create a separate file with the resource policy needed for each event data store that is included in a widget's `QueryStatement`. Name the file `policy.json`, with the following example policy statement: @@ -104 +104,7 @@ In the this example, `?` is surrounded with single quotes because it is used wit -The following example attaches a resource-based policy to an event data store. Replace `account-id` with your account ID, `eds-arn` with the ARN of the event data store for which CloudTrail will run queries, and `dashboard-arn` with the ARN of the dashboard. +Replace `123456789012` with your account ID, `arn:aws:cloudtrail:us-east-1:123456789012:dashboard/exampleDashboard` with the ARN of the dashboard. + +For more information about resource-based policies for dashboards, see [Example: Allow CloudTrail to run queries to refresh a dashboard](./security_iam_resource-based-policy-examples.html#security_iam_resource-based-policy-examples-eds-dashboard). + + 3. Run the `put-resource-policy` command to attach the policy. You can also update an event data store's resource-based policy on the CloudTrail console. + +The following example attaches a resource-based policy to an event data store. @@ -108 +114 @@ The following example attaches a resource-based policy to an event data store. R - --resource-policy '{"Version": "2012-10-17", "Statement": [{"Sid": "EDSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "cloudtrail:StartQuery", "Condition": { "StringEquals": { "AWS:SourceArn": "dashboard-arn", "AWS:SourceAccount": "account-id"}}} ]}' + --resource-policy file://policy.json @@ -110 +116 @@ The following example attaches a resource-based policy to an event data store. R - 3. Run the `put-resource-policy` command to attach a resource-based policy to the dashboard. For an example policy, see [Resource-based policy example for a dashboard](./security_iam_resource-based-policy-examples.html#security_iam_resource-based-policy-examples-dashboards). + 4. Run the `put-resource-policy` command to attach a resource-based policy to the dashboard. For an example policy, see [Resource-based policy example for a dashboard](./security_iam_resource-based-policy-examples.html#security_iam_resource-based-policy-examples-dashboards). @@ -118 +124 @@ The following example attaches a resource-based policy to a dashboard. Replace ` - 4. Run the `update-dashboard` command to set and enable a refresh schedule by configuring the `--refresh-schedule` parameter. + 5. Run the `update-dashboard` command to set and enable a refresh schedule by configuring the `--refresh-schedule` parameter.