AWS sap documentation change
Summary
Replaced placeholder ARNs with concrete example values in IAM policies. Added note about using administrative privileges instead of instance-based privileges to preserve least privilege.
Security assessment
The ARN updates improve clarity but are not security fixes. The added note emphasizes least privilege (a security best practice), but there is no evidence of addressing a specific vulnerability.
Diff
diff --git a/sap/latest/sap-hana/sap-hana-pacemaker-rhel-infra-setup.md b/sap/latest/sap-hana/sap-hana-pacemaker-rhel-infra-setup.md index f53b3a468..11be655d9 100644 --- a//sap/latest/sap-hana/sap-hana-pacemaker-rhel-infra-setup.md +++ b//sap/latest/sap-hana/sap-hana-pacemaker-rhel-infra-setup.md @@ -55,2 +55,2 @@ The Red Hat STONITH resource agent (`fence_aws`) requires permission to start an - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" @@ -74,2 +74,2 @@ The Red Hat Overlay IP resource agent (`aws-vpc-move-ip`) requires permission to - "arn:aws:ec2:<region>:<account_id>:route-table/<routetable_id_1>", - "arn:aws:ec2:<region>:<account_id>:route-table/<routetable_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -117,2 +117,2 @@ After the IAM role has been created, create the following IAM policy on the shar - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<routetable_id_1>", - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<routetable_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -144 +144 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "Resource": "arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc-account-cluster-role>" + "Resource": "arn:aws:iam::123456789012:role/sharing-vpc-account-cluster-role" @@ -163,2 +163,2 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" @@ -231,0 +232,2 @@ AWS CLI +The preceding steps can also be performed programmatically. We suggest performing the steps using administrative privileges, instead of instance-based privileges to preserve least privilege. CreateRoute API isn’t necessary for ongoing operations. +