AWS resilience-hub documentation change
Summary
Removed a detailed IAM policy granting extensive permissions for Resilience Hub operations including access to S3, CloudWatch, SSM, and multiple AWS services
Security assessment
The change removes a full IAM policy example but doesn't reference any specific vulnerability or incident. This appears to be documentation cleanup rather than addressing a security issue. However, removing explicit policy examples could impact security posture if users relied on them for least-privilege configuration.
Diff
diff --git a/resilience-hub/latest/userguide/security-iam-awsmanpol.md b/resilience-hub/latest/userguide/security-iam-awsmanpol.md index c72576277..880ec7afb 100644 --- a//resilience-hub/latest/userguide/security-iam-awsmanpol.md +++ b//resilience-hub/latest/userguide/security-iam-awsmanpol.md @@ -102,205 +101,0 @@ The following IAM policy is required for an AWS account to add permissions for u - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AWSResilienceHubFullResourceStatement", - "Effect": "Allow", - "Action": [ - "application-autoscaling:DescribeScalableTargets", - "autoscaling:DescribeAutoScalingGroups", - "backup:DescribeBackupVault", - "backup:GetBackupPlan", - "backup:GetBackupSelection", - "backup:ListBackupPlans", - "backup:ListBackupSelections", - "cloudformation:DescribeStacks", - "cloudformation:ListStackResources", - "cloudformation:ValidateTemplate", - "cloudwatch:DescribeAlarms", - "cloudwatch:GetMetricData", - "cloudwatch:GetMetricStatistics", - "datasync:DescribeTask", - "datasync:ListLocations", - "datasync:ListTasks", - "devops-guru:ListMonitoredResources", - "dlm:GetLifecyclePolicies", - "dlm:GetLifecyclePolicy", - "docdb-elastic:GetCluster", - "docdb-elastic:GetClusterSnapshot", - "docdb-elastic:ListClusterSnapshots", - "docdb-elastic:ListTagsForResource", - "drs:DescribeJobs", - "drs:DescribeSourceServers", - "drs:GetReplicationConfiguration", - "ds:DescribeDirectories", - "dynamodb:DescribeContinuousBackups", - "dynamodb:DescribeGlobalTable", - "dynamodb:DescribeLimits", - "dynamodb:DescribeTable", - "dynamodb:ListGlobalTables", - "dynamodb:ListTagsOfResource", - "ec2:DescribeAvailabilityZones", - "ec2:DescribeFastSnapshotRestores", - "ec2:DescribeFleets", - "ec2:DescribeHosts", - "ec2:DescribeInstances", - "ec2:DescribeNatGateways", - "ec2:DescribePlacementGroups", - "ec2:DescribeRegions", - "ec2:DescribeSnapshots", - "ec2:DescribeSubnets", - "ec2:DescribeTags", - "ec2:DescribeVolumes", - "ec2:DescribeVpcEndpoints", - "ecr:DescribeRegistry", - "ecs:DescribeCapacityProviders", - "ecs:DescribeClusters", - "ecs:DescribeContainerInstances", - "ecs:DescribeServices", - "ecs:DescribeTaskDefinition", - "ecs:ListContainerInstances", - "ecs:ListServices", - "eks:DescribeCluster", - "eks:DescribeFargateProfile", - "eks:DescribeNodegroup", - "eks:ListFargateProfiles", - "eks:ListNodegroups", - "elasticache:DescribeCacheClusters", - "elasticache:DescribeGlobalReplicationGroups", - "elasticache:DescribeReplicationGroups", - "elasticache:DescribeServerlessCaches", - "elasticahce:DescribeServerlessCacheSnapshots", - "elasticache:DescribeSnapshots", - "elasticfilesystem:DescribeFileSystems", - "elasticfilesystem:DescribeLifecycleConfiguration", - "elasticfilesystem:DescribeMountTargets", - "elasticfilesystem:DescribeReplicationConfigurations", - "elasticloadbalancing:DescribeListeners", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DescribeTargetHealth", - "fis:GetExperiment", - "fis:GetExperimentTemplate", - "fis:ListExperiments", - "fis:ListExperimentResolvedTargets", - "fis:ListExperimentTemplates", - "fsx:DescribeFileSystems", - "lambda:GetFunctionConcurrency", - "lambda:GetFunctionConfiguration", - "lambda:ListAliases", - "lambda:ListEventSourceMappings", - "lambda:ListFunctionEventInvokeConfigs", - "lambda:ListVersionsByFunction", - "rds:DescribeDBClusterSnapshots", - "rds:DescribeDBClusters", - "rds:DescribeDBInstanceAutomatedBackups", - "rds:DescribeDBInstances", - "rds:DescribeDBProxies", - "rds:DescribeDBProxyTargets", - "rds:DescribeDBSnapshots", - "rds:DescribeGlobalClusters", - "rds:ListTagsForResource", - "resource-groups:GetGroup", - "resource-groups:ListGroupResources", - "route53-recovery-control-config:ListClusters", - "route53-recovery-control-config:ListControlPanels", - "route53-recovery-control-config:ListRoutingControls", - "route53-recovery-readiness:GetReadinessCheckStatus", - "route53-recovery-readiness:GetResourceSet", - "route53-recovery-readiness:ListReadinessChecks", - "route53:GetHealthCheck", - "route53:ListHealthChecks", - "route53:ListHostedZones", - "route53:ListResourceRecordSets", - "route53resolver:ListResolverEndpoints", - "route53resolver:ListResolverEndpointIpAddresses", - "s3:ListBucket", - "servicecatalog:GetApplication", - "servicecatalog:ListAssociatedResources", - "sns:GetSubscriptionAttributes", - "sns:GetTopicAttributes", - "sns:ListSubscriptionsByTopic", - "sqs:GetQueueAttributes", - "sqs:GetQueueUrl", - "ssm:DescribeAutomationExecutions", - "states:DescribeStateMachine", - "states:ListStateMachineVersions", - "states:ListStateMachineAliases", - "tag:GetResources" - ], - "Resource": "*" - }, - { - "Sid": "AWSResilienceHubApiGatewayStatement", - "Effect": "Allow", - "Action": [ - "apigateway:GET" - ], - "Resource": [ - "arn:aws:apigateway:*::/apis/*", - "arn:aws:apigateway:*::/restapis/*", - "arn:aws:apigateway:*::/usageplans" - ] - }, - { - "Sid": "AWSResilienceHubS3ArtifactStatement", - "Effect": "Allow", - "Action": [ - "s3:CreateBucket", - "s3:PutObject", - "s3:GetObject" - ], - "Resource": "arn:aws:s3:::aws-resilience-hub-artifacts-*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "AWSResilienceHubS3AccessStatement", - "Effect": "Allow", - "Action": [ - "s3:GetBucketLocation", - "s3:GetBucketLogging", - "s3:GetBucketObjectLockConfiguration", - "s3:GetBucketPolicyStatus", - "s3:GetBucketTagging", - "s3:GetBucketVersioning", - "s3:GetMultiRegionAccessPointRoutes", - "s3:GetReplicationConfiguration", - "s3:ListAllMyBuckets", - "s3:ListMultiRegionAccessPoints" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "AWSResilienceHubCloudWatchStatement", - "Effect": "Allow", - "Action": [ - "cloudwatch:PutMetricData" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": "ResilienceHub" - } - } - }, - {