AWS AWSEC2 medium security documentation change

Service: AWSEC2 · 2025-10-25 · Security-related medium

File: AWSEC2/latest/UserGuide/cm-set-up-s3-export.md

Summary

Modified S3 bucket policy to use `ArnLike` instead of `StringEquals` for `aws:SourceArn` condition.

Security assessment

The policy change corrects a potential misconfiguration by using `ArnLike` with a wildcard pattern, which is more secure for ARN matching. This addresses a security concern where overly permissive conditions could allow unintended access.

Diff

diff --git a/AWSEC2/latest/UserGuide/cm-set-up-s3-export.md b/AWSEC2/latest/UserGuide/cm-set-up-s3-export.md
index a0f6427d9..b58e1b84d 100644
--- a//AWSEC2/latest/UserGuide/cm-set-up-s3-export.md
+++ b//AWSEC2/latest/UserGuide/cm-set-up-s3-export.md
@@ -18,2 +18 @@ The following policy must be applied to your S3 bucket to allow Capacity Manager
-        "Statement":
-        [
+        "Statement": [
@@ -22,2 +21 @@ The following policy must be applied to your S3 bucket to allow Capacity Manager
-                "Principal":
-                {
+                "Principal": {
@@ -26,2 +24 @@ The following policy must be applied to your S3 bucket to allow Capacity Manager
-                "Action":
-                [
+                "Action": [
@@ -32,2 +29 @@ The following policy must be applied to your S3 bucket to allow Capacity Manager
-                "Resource":
-                [
+                "Resource": [
@@ -37,4 +33,2 @@ The following policy must be applied to your S3 bucket to allow Capacity Manager
-                "Condition":
-                {
-                    "StringEquals":
-                    {
+                "Condition": {
+                    "StringEquals": {
@@ -43,3 +37,2 @@ The following policy must be applied to your S3 bucket to allow Capacity Manager
-                    "StringLike":
-                    {
-                        "aws:SourceArn": "arn:aws:ec2:aws-region:111122223333:capacity-manager-data-export/*"
+                    "ArnLike": {
+                        "aws:SourceArn": "arn:aws:ec2:us-east-1:111122223333:capacity-manager-data-export/*"