AWS sap documentation change
Summary
Replaced placeholder ARNs with concrete example values in IAM policies. Added note about using administrative privileges instead of instance-based privileges to preserve least privilege.
Security assessment
Similar to the RHEL file, the ARN changes are documentation improvements. The added note promotes least privilege (security best practice) but does not resolve a specific security incident.
Diff
diff --git a/sap/latest/sap-hana/sap-hana-pacemaker-sles-infra-setup.md b/sap/latest/sap-hana/sap-hana-pacemaker-sles-infra-setup.md index 9350b222a..efaf6cca8 100644 --- a//sap/latest/sap-hana/sap-hana-pacemaker-sles-infra-setup.md +++ b//sap/latest/sap-hana/sap-hana-pacemaker-sles-infra-setup.md @@ -55,2 +55,2 @@ The SLES STONITH resource agent (external/ec2) requires permission to start and - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" @@ -74,2 +74,2 @@ The SLES Overlay IP resource agent (aws-vpc-move-ip) requires permission to modi - "arn:aws:ec2:<region>:<account_id>:route-table/<routetable_id_1>", - "arn:aws:ec2:<region>:<account_id>:route-table/<routetable_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -130,2 +130,2 @@ After the IAM role has been created, create the following IAM policy on the shar - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<routetable_id_1>", - "arn:aws:ec2:<region>:<sharing_vpc_account_id>:route_table/<routetable_id_2>" + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0", + "arn:aws:ec2:us-east-1:123456789012:route-table/rtb-0123456789abcdef0" @@ -157 +157 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "Resource": "arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc-account-cluster-role>" + "Resource": "arn:aws:iam::123456789012:role/sharing-vpc-account-cluster-role" @@ -176,2 +176,2 @@ In cluster account, create the following IAM policy, and attach it to an IAM rol - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_1>", - "arn:aws:ec2:<region>:<cluster_account_id>:instance/<instance_id_2>" + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0", + "arn:aws:ec2:us-east-1:123456789012:instance/arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" @@ -245,0 +246,2 @@ AWS CLI +The preceding steps can also be performed programmatically. We suggest performing the steps using administrative privileges, instead of instance-based privileges to preserve least privilege. CreateRoute API isn’t necessary for ongoing operations. +