AWS whitepapers documentation change
Summary
Replaced detailed IAM policy with placeholder and JSON headers
Security assessment
Removes specific policy examples without replacement, reducing documentation clarity but not addressing vulnerabilities
Diff
diff --git a/whitepapers/latest/setting-up-multi-user-environments/appendix-b.md b/whitepapers/latest/setting-up-multi-user-environments/appendix-b.md index 148ce13c2..558866a27 100644 --- a//whitepapers/latest/setting-up-multi-user-environments/appendix-b.md +++ b//whitepapers/latest/setting-up-multi-user-environments/appendix-b.md @@ -77,35 +77 @@ This section provides example IAM user policies for a class that uses AWS servic - { - "Version": "2012-10-17", - "Statement": [{ - "Effect": "Allow", - "Action": [ - "ec2:DescribeVolumes", - "ec2:DescribeAvailabilityZones", - "ec2:CreateVolume", - "ec2:DescribeInstances" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "ec2:AttachVolume", - "ec2:DetachVolume" - ], - "Resource": "arn:aws:ec2:region:111122223333:instance/*", - "Condition": { - "StringEquals": { - "ec2:ResourceTag/purpose": "test" - } - } - }, - { - "Effect": "Allow", - "Action": [ - "ec2:AttachVolume", - "ec2:DetachVolume" - ], - "Resource": "arn:aws:ec2:region:111122223333:volume/*" - } - ] - } + * Permission to create and modify Amazon EC2 instances: @@ -112,0 +79,4 @@ This section provides example IAM user policies for a class that uses AWS servic +JSON + + +**** @@ -114 +83,0 @@ This section provides example IAM user policies for a class that uses AWS servic - * Permission to create and modify Amazon EC2 instances: @@ -145,0 +116,6 @@ This section provides example IAM user policies for a class that uses AWS servic +JSON + + +**** + + @@ -160,25 +135,0 @@ This section provides example IAM user policies for a class that uses AWS servic - * For instances with a student tag, allows students to restart, stop, reboot, attach volumes, and detach volumes. If the professor or teaching assistant applies a student tag with the value being the IAM user name of specific students to specific instances, then those students can stop, reboot, attach volumes to, and detach volumes to those instances. They can also start instances that they stopped (that still have the student tag on them), but they can’t start new ones. - - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "ec2:StartInstances", - "ec2:StopInstances", - "ec2:RebootInstances", - "ec2:AttachVolume", - "ec2:DetachVolume" - ], - "Condition": { - "StringEquals": { - "ec2:ResourceTag/Student":"${aws:username}" - } - }, - "Resource": [ - "arn:aws:ec2:region:account:instance/*", - "arn:aws:ec2:region:account:volume/*" - ], - "Effect": "Allow" - }] - } @@ -185,0 +137 @@ This section provides example IAM user policies for a class that uses AWS servic + * For instances with a student tag, allows students to restart, stop, reboot, attach volumes, and detach volumes. If the professor or teaching assistant applies a student tag with the value being the IAM user name of specific students to specific instances, then those students can stop, reboot, attach volumes to, and detach volumes to those instances. They can also start instances that they stopped (that still have the student tag on them), but they can’t start new ones.