AWS sap documentation change
Summary
Updated IAM policy examples with specific ARNs (including invalid instance ARN formats)
Security assessment
Changes introduce example ARNs with region/account specifics but contain formatting errors (e.g., nested ARNs in instance IDs). While incorrect ARNs could lead to misconfiguration, there's no evidence of addressing a known vulnerability
Diff
diff --git a/sap/latest/sap-AnyDB/ase-sles-ha-settings.md b/sap/latest/sap-AnyDB/ase-sles-ha-settings.md index f7808d7c8..d33d5943f 100644 --- a//sap/latest/sap-AnyDB/ase-sles-ha-settings.md +++ b//sap/latest/sap-AnyDB/ase-sles-ha-settings.md @@ -170,2 +170,2 @@ The SLES STONITH resource agent (`external/ec2`) requires permission to start an - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" @@ -189,2 +189,2 @@ The SLES Overlay IP resource agent (`aws-vpc-move-ip`) requires permission to mo - "arn:aws:ec2:<region>:<account_id>:route-table/<rtb_id_1>", - "arn:aws:ec2:<region>:<account_id>:route-table/<rtb_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -683,2 +683,2 @@ After the IAM role has been created, create the following IAM policy on the shar - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<rtb_id_1>", - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<rtb_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -712 +712 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "Resource": "arn:aws:iam::<sharing_vpc_account_id>:role/<sharing _vpc-account-cluster-role>" + "Resource": "arn:aws:iam::123456789012:role/sharing-vpc-account-cluster-role" @@ -731,2 +731,2 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0"