AWS workmail documentation change
Summary
Updated IAM policy examples with concrete region (us-east-1) and account ID (111122223333) values in ARNs, added JSON formatting sections
Security assessment
The changes provide specific implementation examples for audit logging configurations, improving clarity of security-related IAM policies. While this enhances security documentation quality, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/workmail/latest/adminguide/audit-logging.md b/workmail/latest/adminguide/audit-logging.md index a49065c82..621d718e1 100644 --- a//workmail/latest/adminguide/audit-logging.md +++ b//workmail/latest/adminguide/audit-logging.md @@ -86,0 +87,6 @@ To enable sending logs to CloudWatch Logs, you must be signed in with the follow +JSON + + +**** + + @@ -109,3 +115,3 @@ To enable sending logs to CloudWatch Logs, you must be signed in with the follow - "arn:aws:logs:region:account-id:delivery:*", - "arn:aws:logs:region:account-id:delivery-source:*", - "arn:aws:logs:region:account-id:delivery-destination:*" + "arn:aws:logs:us-east-1:111122223333:delivery:*", + "arn:aws:logs:us-east-1:111122223333:delivery-source:*", + "arn:aws:logs:us-east-1:111122223333:delivery-destination:*" @@ -134 +140 @@ To enable sending logs to CloudWatch Logs, you must be signed in with the follow - "arn:aws:logs:region:account-id:*" + "arn:aws:logs:us-east-1:111122223333:*" @@ -136 +142 @@ To enable sending logs to CloudWatch Logs, you must be signed in with the follow - } + }, @@ -144 +150 @@ To enable sending logs to CloudWatch Logs, you must be signed in with the follow - "arn:aws:workmail:region:account-id:organization/organization-id" + "arn:aws:workmail:us-east-1:111122223333:organization/organization-id" @@ -207,0 +215,6 @@ To enable sending logs to Amazon S3, you must be signed in with the following pe +JSON + + +**** + + @@ -230,3 +243,3 @@ To enable sending logs to Amazon S3, you must be signed in with the following pe - "arn:aws:logs:region:account-id:delivery:*", - "arn:aws:logs:region:account-id:delivery-source:*", - "arn:aws:logs:region:account-id:delivery-destination:*" + "arn:aws:logs:us-east-1:111122223333:delivery:*", + "arn:aws:logs:us-east-1:111122223333:delivery-source:*", + "arn:aws:logs:us-east-1:111122223333:delivery-destination:*" @@ -254 +267 @@ To enable sending logs to Amazon S3, you must be signed in with the following pe - } + }, @@ -262 +275 @@ To enable sending logs to Amazon S3, you must be signed in with the following pe - "arn:aws:workmail:region:account-id:organization/organization-id" + "arn:aws:workmail:us-east-1:111122223333:organization/organization-id" @@ -388,0 +403,6 @@ To enable sending logs to Firehose, you must be signed in with the following per +JSON + + +**** + + @@ -411,3 +431,3 @@ To enable sending logs to Firehose, you must be signed in with the following per - "arn:aws:logs:region:account-id:delivery:*", - "arn:aws:logs:region:account-id:delivery-source:*", - "arn:aws:logs:region:account-id:delivery-destination:*" + "arn:aws:logs:us-east-1:111122223333:delivery:*", + "arn:aws:logs:us-east-1:111122223333:delivery-source:*", + "arn:aws:logs:us-east-1:111122223333:delivery-destination:*" @@ -434 +454 @@ To enable sending logs to Firehose, you must be signed in with the following per - "arn:aws:firehose:region:account-id:deliverystream/*" + "arn:aws:firehose:us-east-1:111122223333:deliverystream/*" @@ -443,2 +463,2 @@ To enable sending logs to Firehose, you must be signed in with the following per - "Resource": "arn:aws:iam::account-id:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery" - } + "Resource": "arn:aws:iam::111122223333:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery" + }, @@ -452 +472 @@ To enable sending logs to Firehose, you must be signed in with the following per - "arn:aws:workmail:region:account-id:organization/organization-id" + "arn:aws:workmail:us-east-1:111122223333:organization/organization-id"