AWS sap documentation change
Summary
Added documentation about instance stop protection/source-dest checks + updated IAM ARN examples
Security assessment
Added instructions for EC2 instance protection features (security documentation) alongside example ARN updates. ARN changes contain formatting errors but don't address vulnerabilities
Diff
diff --git a/sap/latest/sap-AnyDB/rhel-ase-ha-settings.md b/sap/latest/sap-AnyDB/rhel-ase-ha-settings.md index 064ed4a6e..cb0678ef3 100644 --- a//sap/latest/sap-AnyDB/rhel-ase-ha-settings.md +++ b//sap/latest/sap-AnyDB/rhel-ase-ha-settings.md @@ -167,2 +167,2 @@ The RHEL STONITH agent requires permission to start and stop both the nodes of t - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" @@ -186,2 +186,2 @@ The RHEL Overlay IP resource agent (`aws-vpc-move-ip`) requires permission to mo - "arn:aws:ec2:<region>:<account_id>:route-table/<rtb_id_1>", - "arn:aws:ec2:<region>:<account_id>:route-table/<rtb_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -230,0 +231,2 @@ AWS CLI +Use the [modify-instance-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html) command to disable source/destination check. + @@ -246,0 +249,2 @@ AWS Management Console +Ensure that the **Stop** option is checked in [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + @@ -618,2 +622,2 @@ After the IAM role has been created, create the following IAM policy on the shar - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<rtb_id_1>", - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<rtb_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -647 +651 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "Resource": "arn:aws:iam::<sharing_vpc_account_id>:role/<sharing _vpc-account-cluster-role>" + "Resource": "arn:aws:iam::123456789012:role/sharing-vpc-account-cluster-role" @@ -666,2 +670,2 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0"