AWS pinpoint documentation change
Summary
Updated IAM policy examples with concrete region (us-east-1), account ID (111122223333), and resource ARNs. Added JSON section markers and fixed policy syntax formatting.
Security assessment
Changes replace placeholder values with specific examples but do not address vulnerabilities. Updates to policy version (2008→2012) and condition operators (StringLike→ArnLike) reflect security best practices for policy validation, but there's no evidence of addressing an active security incident.
Diff
diff --git a/pinpoint/latest/developerguide/security_iam_id-based-policy-examples.md b/pinpoint/latest/developerguide/security_iam_id-based-policy-examples.md index 5f8475bfb..3e8489b0e 100644 --- a//pinpoint/latest/developerguide/security_iam_id-based-policy-examples.md +++ b//pinpoint/latest/developerguide/security_iam_id-based-policy-examples.md @@ -64,0 +65,6 @@ The following example policy provides read-only access to the Amazon Pinpoint co +JSON + + +**** + + @@ -76 +82 @@ The following example policy provides read-only access to the Amazon Pinpoint co - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -107,0 +115,6 @@ You can also create read-only policies that provide access to only specific proj +JSON + + +**** + + @@ -116 +129 @@ You can also create read-only policies that provide access to only specific proj - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -125,3 +138,3 @@ You can also create read-only policies that provide access to only specific proj - "arn:aws:mobiletargeting:region:accountId:apps/projectId", - "arn:aws:mobiletargeting:region:accountId:apps/projectId/*", - "arn:aws:mobiletargeting:region:accountId:reports" + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId", + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId/*", + "arn:aws:mobiletargeting:us-east-1:111122223333:reports" @@ -157,0 +172,6 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti +JSON + + +**** + + @@ -166 +186 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -178,3 +198,3 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti - "arn:aws:mobiletargeting:region:accountId:apps/810c7aab86d42fb2b56c8c966example", - "arn:aws:mobiletargeting:region:accountId:apps/810c7aab86d42fb2b56c8c966example/*", - "arn:aws:mobiletargeting:region:accountId:reports" + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/810c7aab86d42fb2b56c8c966example", + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/810c7aab86d42fb2b56c8c966example/*", + "arn:aws:mobiletargeting:us-east-1:111122223333:reports" @@ -198 +218 @@ In addition to granting permissions for `mobiletargeting:Get` and `mobiletargeti - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "111122223333" @@ -208,0 +230,6 @@ You can use conditions in an identity-based policy to control access to Amazon P +JSON + + +**** + + @@ -235 +262 @@ You can use conditions in an identity-based policy to control access to Amazon P - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "111122223333" @@ -238 +265 @@ You can use conditions in an identity-based policy to control access to Amazon P - "aws:SourceArn": "arn:aws:mobiletargeting:region:accountId:*" + "aws:SourceArn": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -292,0 +321,6 @@ The following example policy allows read-only access to all the resources in you +JSON + + +**** + + @@ -304 +338 @@ The following example policy allows read-only access to all the resources in you - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -314,0 +350,6 @@ The following example policy allows full access to all Amazon Pinpoint actions a +JSON + + +**** + + @@ -325 +366 @@ The following example policy allows full access to all Amazon Pinpoint actions a - "Resource": "arn:aws:mobiletargeting:region:accountId:*" + "Resource": "arn:aws:mobiletargeting:us-east-1:111122223333:*" @@ -339,0 +382,6 @@ The following example policy allows read-only access to all Amazon Pinpoint SMS +JSON + + +**** + + @@ -354 +402 @@ The following example policy allows read-only access to all Amazon Pinpoint SMS - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "111122223333" @@ -357 +405 @@ The following example policy allows read-only access to all Amazon Pinpoint SMS - "aws:SourceArn": "arn:aws:sms-voice:region:accountId:*" + "aws:SourceArn": "arn:aws:sms-voice:us-east-1:111122223333:*" @@ -367,0 +417,6 @@ The following example policy allows full access to all Amazon Pinpoint SMS and V +JSON + + +**** + + @@ -376 +431 @@ The following example policy allows full access to all Amazon Pinpoint SMS and V - "sms-voice:*", + "sms-voice:*" @@ -381 +436 @@ The following example policy allows full access to all Amazon Pinpoint SMS and V - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "111122223333" @@ -384 +439 @@ The following example policy allows full access to all Amazon Pinpoint SMS and V - "aws:SourceArn": "arn:aws:sms-voice:region:accountId:*" + "aws:SourceArn": "arn:aws:sms-voice:us-east-1:111122223333:*" @@ -396,0 +453,6 @@ The condition in this statement identifies the `54.240.143.*` range of allowed I +JSON + + +**** + + @@ -408,2 +470,2 @@ The condition in this statement identifies the `54.240.143.*` range of allowed I - "arn:aws:mobiletargeting:region:accountId:apps/projectId", - "arn:aws:mobiletargeting:region:accountId:apps/projectId/*" + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId", + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId/*" @@ -426,0 +490,6 @@ The following example policy grants permissions to perform any Amazon Pinpoint a +JSON + + +**** + + @@ -436,2 +505,2 @@ The following example policy grants permissions to perform any Amazon Pinpoint a - "arn:aws:mobiletargeting:region:accountId:apps/projectId", - "arn:aws:mobiletargeting:region:accountId:apps/projectId/*" + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId", + "arn:aws:mobiletargeting:us-east-1:111122223333:apps/projectId/*" @@ -453,0 +524,6 @@ The following example policy grants Amazon Pinpoint permission to send email usi +JSON + + +**** + + @@ -456 +532 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "Version":"2008-10-17", + "Version":"2012-10-17", @@ -465 +541 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "Resource":"arn:aws:ses:region:accountId:identity/emailId", + "Resource":"arn:aws:ses:us-east-1:111122223333:identity/emailId", @@ -468 +544 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "aws:SourceAccount":"accountId" + "aws:SourceAccount":"111122223333" @@ -470,2 +546,2 @@ The following example policy grants Amazon Pinpoint permission to send email usi - "StringLike":{ - "aws:SourceArn":"arn:aws:mobiletargeting:region:accountId:apps/*" + "ArnLike":{ + "aws:SourceArn":"arn:aws:mobiletargeting:us-east-1:111122223333:apps/*" @@ -479,0 +557,6 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi +JSON + + +**** + + @@ -482 +565 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "Version":"2008-10-17", + "Version":"2012-10-17", @@ -491 +574 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "Resource":"arn:aws-us-gov:ses:us-gov-west-1:accountId:identity/emailId", + "Resource":"arn:aws-us-gov:ses:us-gov-west-1:111122223333:identity/emailId", @@ -494 +577 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "aws:SourceAccount":"accountId" + "aws:SourceAccount":"111122223333" @@ -496,2 +579,2 @@ If you use Amazon Pinpoint in the AWS GovCloud (US-West) Region, use the followi - "StringLike":{ - "aws:SourceArn":"arn:aws-us-gov:mobiletargeting:us-gov-west-1:accountId:apps/*" + "ArnLike":{ + "aws:SourceArn":"arn:aws-us-gov:mobiletargeting:us-gov-west-1:111122223333:apps/*"