AWS workspaces-core medium security documentation change

Service: workspaces-core · 2025-10-25 · Security-related medium

File: workspaces-core/latest/pg/tag-based-auth-guidelines.md

Summary

Corrected IAM policy syntax (action names and tag condition keys), added JSON formatting, and fixed resource tag validation logic.

Security assessment

Fixes incorrect IAM policy syntax (e.g., 'ws:CreateWorkspaces' → 'workspaces:CreateWorkspaces') and tag condition misconfiguration ('RequestTag' → 'ResourceTag'). These corrections prevent potential policy enforcement failures that could allow unauthorized tag modifications or resource creation.

Diff

diff --git a/workspaces-core/latest/pg/tag-based-auth-guidelines.md b/workspaces-core/latest/pg/tag-based-auth-guidelines.md
index 3577dcc64..3b077d371 100644
--- a//workspaces-core/latest/pg/tag-based-auth-guidelines.md
+++ b//workspaces-core/latest/pg/tag-based-auth-guidelines.md
@@ -31,0 +32,6 @@ The following tag keys policy example only allows API actions to use tag keys 
+JSON
+    
+
+****
+    
+    
@@ -39 +45 @@ The following tag keys policy example only allows API actions to use tag keys 
-    ws:CreateWorkspaces
+    				"workspaces:CreateWorkspaces"
@@ -44 +50 @@ The following tag keys policy example only allows API actions to use tag keys 
-    "aws:RequestTag/PartnerManaged": "true"
+    					"aws:ResourceTag/PartnerManaged": "true"
@@ -59,0 +67,6 @@ The following resource tag policy example ensures that modifications can only ha
+JSON
+    
+
+****
+    
+    
@@ -67 +80 @@ The following resource tag policy example ensures that modifications can only ha
-    ws:ModifyWorkspaceProperties
+    				"workspaces:ModifyWorkspaceProperties"
@@ -87,0 +102,6 @@ API name | Tag condition request | Assumed role policy for UserTag | Note
+JSON
+    
+
+****
+    
+    
@@ -91 +111,2 @@ API name | Tag condition request | Assumed role policy for UserTag | Note
-    "Statement":[ {
+    	"Statement": [
+    		{
@@ -99,2 +120 @@ API name | Tag condition request | Assumed role policy for UserTag | Note
-    "aws:RequestTag/PartnerManaged":"tru
-    e"
+    					"aws:RequestTag/PartnerManaged": "true"
@@ -112,0 +134,6 @@ API name | Tag condition request | Assumed role policy for UserTag | Note
+JSON
+    
+
+****
+    
+    
@@ -125,2 +152 @@ API name | Tag condition request | Assumed role policy for UserTag | Note
-    "aws:ResourceTag/PartnerManaged":"tr
-    ue"
+    					"aws:ResourceTag/PartnerManaged": "true"