AWS pinpoint medium security documentation change
Summary
Updated IAM policy examples with concrete region/account values and corrected policy syntax. Added JSON section markers and formatting.
Security assessment
Changed policy version from 2008-10-17 to 2012-10-17 (current standard), replaced placeholder account IDs with concrete values (111122223333), and updated condition operators from StringLike to ArnLike. These changes enforce proper policy syntax, prevent accidental wildcard use, and demonstrate secure resource ARN construction - critical for preventing privilege escalation.
Diff
diff --git a/pinpoint/latest/archguide/security_iam_id-based-policy-examples.md b/pinpoint/latest/archguide/security_iam_id-based-policy-examples.md index 37ee680e2..21dfbb86c 100644 --- a//pinpoint/latest/archguide/security_iam_id-based-policy-examples.md +++ b//pinpoint/latest/archguide/security_iam_id-based-policy-examples.md @@ -64,0 +65,6 @@ The following example policy provides read-only access to the Amazon Pinpoint co +JSON + + +**** + + @@ -76 +82 @@ The following example policy provides read-only access to the Amazon Pinpoint co - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -102,0 +110,6 @@ You can also create read-only policies that only provide access to specific proj +JSON + + +**** + + @@ -111 +124 @@ You can also create read-only policies that only provide access to specific proj - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -120,3 +133,3 @@ You can also create read-only policies that only provide access to specific proj - "arn:aws:mobiletargeting:region:accountId:apps/projectId", - "arn:aws:mobiletargeting:region:accountId:apps/projectId/*", - "arn:aws:mobiletargeting:region:accountId:reports" + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId", + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId/*", + "arn:aws:mobiletargeting:us-east-1:111122223333:reports" @@ -147,0 +162,6 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti +JSON + + +**** + + @@ -156 +176 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -168,3 +188,3 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti - "arn:aws:mobiletargeting:region:accountId:apps/810c7aab86d42fb2b56c8c966example", - "arn:aws:mobiletargeting:region:accountId:apps/810c7aab86d42fb2b56c8c966example/*", - "arn:aws:mobiletargeting:region:accountId:reports" + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/810c7aab86d42fb2b56c8c966example", + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/810c7aab86d42fb2b56c8c966example/*", + "arn:aws:mobiletargeting:us-east-1:111122223333:reports" @@ -193,0 +215,6 @@ You can use conditions in an identity-based policy to control access to Amazon P +JSON + + +**** + + @@ -269,0 +298,6 @@ The following example policy allows you read-only access to all the resources in +JSON + + +**** + + @@ -281 +315 @@ The following example policy allows you read-only access to all the resources in - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -291,0 +327,6 @@ The following example policy allows you full access to all Amazon Pinpoint actio +JSON + + +**** + + @@ -302 +343 @@ The following example policy allows you full access to all Amazon Pinpoint actio - "Resource": "arn:aws:mobiletargeting:*:accountId:*" + "Resource": "arn:aws:mobiletargeting:*:111122223333:*" @@ -316,0 +359,6 @@ The following example policy allows you read-only access to all Amazon Pinpoint +JSON + + +**** + + @@ -337,0 +387,6 @@ The following example policy allows you full access to all Amazon Pinpoint SMS a +JSON + + +**** + + @@ -359,0 +416,6 @@ The condition in this statement identifies the `54.240.143.*` range of allowed I +JSON + + +**** + + @@ -387,0 +451,6 @@ The `Condition` block uses the `StringEquals` condition and the `aws:`ResourceTa +JSON + + +**** + + @@ -412,0 +483,6 @@ The following example policy grants Amazon Pinpoint permission to send email usi +JSON + + +**** + + @@ -415 +491 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "Version": "2008-10-17", + "Version":"2012-10-17", @@ -424 +500 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "Resource": "arn:aws:ses:region:accountId:identity/emailId", + "Resource": "arn:aws:ses:us-east-1:111122223333:identity/emailId", @@ -427 +503 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "aws:SourceAccount": "accountId", + "aws:SourceAccount": "111122223333" @@ -429,2 +505,2 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "StringLike": { - "aws:SourceArn": "arn:aws:mobiletargeting:region:accountId:apps/*" + "ArnLike": { + "aws:SourceArn": "arn:aws:mobiletargeting:us-east-1:111122223333:apps/*" @@ -438,0 +516,6 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi +JSON + + +**** + + @@ -441 +524 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "Version": "2008-10-17", + "Version":"2012-10-17", @@ -450 +533 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "Resource": "arn:aws-us-gov:ses:us-gov-west-1:accountId:identity/emailId", + "Resource": "arn:aws-us-gov:ses:us-gov-west-1:111122223333:identity/emailId", @@ -453 +536 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "111122223333" @@ -455,2 +538,2 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "StringLike": { - "aws:SourceArn": "arn:aws-us-gov:mobiletargeting:us-gov-west-1:accountId:apps/*" + "ArnLike": { + "aws:SourceArn": "arn:aws-us-gov:mobiletargeting:us-gov-west-1:111122223333:apps/*"