AWS inspector documentation change
Summary
Removed detailed explanations about policy principal restrictions, cross-account access requirements, and policy action implementation details
Security assessment
Changes streamline IAM policy documentation without modifying security recommendations. Removal of explanatory text about cross-account trust relationships and policy elements does not indicate security fixes.
Diff
diff --git a/inspector/v1/userguide/security_iam_service-with-iam.md b/inspector/v1/userguide/security_iam_service-with-iam.md index 9f09cea95..5d1aa1b0c 100644 --- a//inspector/v1/userguide/security_iam_service-with-iam.md +++ b//inspector/v1/userguide/security_iam_service-with-iam.md @@ -35 +35 @@ Identity-based policies are JSON permissions policy documents that you can attac -With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. You can't specify the principal in an identity-based policy because it applies to the user or role to which it is attached. To learn about all of the elements that you can use in a JSON policy, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) in the _IAM User Guide_. +With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. To learn about all of the elements that you can use in a JSON policy, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) in the _IAM User Guide_. @@ -47 +47 @@ Resource-based policies are JSON policy documents that you attach to a resource. -To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. Adding a cross-account principal to a resource-based policy is only half of establishing the trust relationship. When the principal and the resource are in different AWS accounts, an IAM administrator in the trusted account must also grant the principal entity (user or role) permission to access the resource. They grant permission by attaching an identity-based policy to the entity. However, if a resource-based policy grants access to a principal in the same account, no additional identity-based policy is required. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the _IAM User Guide_. +To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the _IAM User Guide_. @@ -55,3 +55 @@ Administrators can use AWS JSON policies to specify who has access to what. That -The `Action` element of a JSON policy describes the actions that you can use to allow or deny access in a policy. Policy actions usually have the same name as the associated AWS API operation. There are some exceptions, such as _permission-only actions_ that don't have a matching API operation. There are also some operations that require multiple actions in a policy. These additional actions are called _dependent actions_. - -Include actions in a policy to grant permissions to perform the associated operation. +The `Action` element of a JSON policy describes the actions that you can use to allow or deny access in a policy. Include actions in a policy to grant permissions to perform the associated operation.