AWS proton documentation change

Service: proton · 2025-10-25 · Documentation low

File: proton/latest/userguide/security_iam_service-role-policy-examples.md

Summary

Added IAM policy example with CloudFormation/S3 permissions

Security assessment

New example demonstrates least-privilege access with AWS:CalledVia condition. Enhances security documentation but doesn't resolve specific known issues.

Diff

diff --git a/proton/latest/userguide/security_iam_service-role-policy-examples.md b/proton/latest/userguide/security_iam_service-role-policy-examples.md
index da84bcad0..a5c9f58fb 100644
--- a//proton/latest/userguide/security_iam_service-role-policy-examples.md
+++ b//proton/latest/userguide/security_iam_service-role-policy-examples.md
@@ -276,0 +277,54 @@ JSON
+****
+    
+    
+    
+    {
+      "Version":"2012-10-17",		 	 	 
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "cloudformation:CancelUpdateStack",
+            "cloudformation:CreateChangeSet",
+            "cloudformation:DeleteChangeSet",
+            "cloudformation:DescribeStacks",
+            "cloudformation:ContinueUpdateRollback",
+            "cloudformation:DetectStackResourceDrift",
+            "cloudformation:DescribeStackResourceDrifts",
+            "cloudformation:DescribeStackEvents",
+            "cloudformation:CreateStack",
+            "cloudformation:DeleteStack",
+            "cloudformation:UpdateStack",
+            "cloudformation:DescribeChangeSet",
+            "cloudformation:ExecuteChangeSet",
+            "cloudformation:ListChangeSets",
+            "cloudformation:ListStackResources"
+          ],
+          "Resource": "arn:aws:cloudformation:*:123456789012:stack/AWSProton-*"
+        },
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:CreateBucket",
+            "s3:DeleteBucket",
+            "s3:GetBucket*",
+            "iam:CreatePolicy",
+            "iam:DeletePolicy",
+            "iam:GetPolicy",
+            "iam:ListPolicyVersions",
+            "iam:DeletePolicyVersion"
+          ],
+          "Resource": "*",
+          "Condition": {
+            "ForAnyValue:StringEquals": {
+              "aws:CalledVia": "cloudformation.amazonaws.com"
+            }
+          }
+        }
+      ]
+    }
+    
+
+JSON
+    
+