AWS managedservices documentation change
Summary
Updated multiple change type labels from '(review required)' to '(Managed Automation)', indicating automation process improvements
Security assessment
The changes reflect a shift from manual review processes to managed automation for various operations, but there's no explicit mention of security vulnerabilities being addressed. While automation can improve security posture by reducing human error, the diff itself doesn't provide direct evidence of patching security flaws or addressing specific vulnerabilities.
Diff
diff --git a/managedservices/latest/ctexguide/review-walkthroughs.md b/managedservices/latest/ctexguide/review-walkthroughs.md index e6620c811..599b19959 100644 --- a//managedservices/latest/ctexguide/review-walkthroughs.md +++ b//managedservices/latest/ctexguide/review-walkthroughs.md @@ -5 +5 @@ -Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete NAT gateway (Review Required)Update EC2 Instance Metadata Service (IMDS) Region SettingCreate a computer object's SPNDelete target groups (review required)Create application load balancer (ALB)Update application load balancer (ALB)Create listenerHigh availability one-tier stacks: CreatingCreate IAM entity or policy (review required)Continue rollback on custom AWS CloudFormation stackManage the VPC Subnet IPv4 Address Auto AssigmentSchedule addDelete EBS snapshot (Review Required)Update SNS topicCreate an S3 access pointCreate Custom RDS Parameter GroupAdd event notification to an Amazon S3 bucketUpdate custom deny list for AMS Automated IAM ProvisioningMigrate AWS Managed Account DNS resolver to Route 53 for SALZ accounts (review required)Disassociate resolver rules from VPCUpdate Enhanced MonitoringAssociate VPC with Resolver RuleDeploy AMS pattern (review required)Share AWS KMS KeyCreate Active Directory TrustOverride Stack Access Duration (Review required)Enable automated IAM provisioning with read-write permissionsAdd VPC static route (review required)Create IAM entity or policyUpdate IAM entity or policyDelete IAM entity or policyUpdate detailed monitoringShare directoryUnshare directoryCreate VPC endpointUpdate RDS storageUpdate an RDS multi-AZ deploymentUpdate an RDS instance typeUpdate S3 bucket versioningUpdate S3 bucket encryptionUpdating an application account (review required)Associate private IP addresses (review required) ct-1pvlhug439gl2Create Amazon RDS option group (review required)Remove TGW static routeCreate for WIGS (Review Required)Modify EBS volumeUpdate AWS Backup plan (review required)Confirm offboardingManagement account: Offboard Application accountDeploy AMS Resource Scheduler SolutionUpdate AMS Resource Scheduler SolutionDelete or deactivate access keyCreate access keyEnable Detailed MonitoringUpdate the DeleteOnTermination option (review required)Update RDS maintainance window (review required)Update RDS performance insights (review required)Create security group (review required) +Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete NAT gateway (Managed Automation)Update EC2 Instance Metadata Service (IMDS) Region SettingCreate a computer object's SPNDelete target groups (Managed Automation)Create application load balancer (ALB)Update application load balancer (ALB)Create listenerHigh availability one-tier stacks: CreatingCreate IAM entity or policy (Managed Automation)Continue rollback on custom AWS CloudFormation stackManage the VPC Subnet IPv4 Address Auto AssigmentSchedule addDelete EBS snapshot (Managed Automation)Update SNS topicCreate an S3 access pointCreate Custom RDS Parameter GroupAdd event notification to an Amazon S3 bucketUpdate custom deny list for AMS Automated IAM ProvisioningMigrate AWS Managed Account DNS resolver to Route 53 for SALZ accounts (Managed Automation)Disassociate resolver rules from VPCUpdate Enhanced MonitoringAssociate VPC with Resolver RuleDeploy AMS pattern (Managed Automation)Share AWS KMS KeyCreate Active Directory TrustOverride Stack Access Duration (Managed automation)Enable automated IAM provisioning with read-write permissionsAdd VPC static route (Managed Automation)Create IAM entity or policyUpdate IAM entity or policyDelete IAM entity or policyUpdate detailed monitoringShare directoryUnshare directoryCreate VPC endpointUpdate RDS storageUpdate an RDS multi-AZ deploymentUpdate an RDS instance typeUpdate S3 bucket versioningUpdate S3 bucket encryptionUpdating an application account (Managed Automation)Associate private IP addresses (Managed Automation) ct-1pvlhug439gl2Create Amazon RDS option group (Managed Automation)Remove TGW static routeCreate for WIGS (Managed Automation)Modify EBS volumeUpdate AWS Backup plan (Managed Automation)Confirm offboardingManagement account: Offboard Application accountDeploy AMS Resource Scheduler SolutionUpdate AMS Resource Scheduler SolutionDelete or deactivate access keyCreate access keyEnable Detailed MonitoringUpdate the DeleteOnTermination option (Managed Automation)Update RDS maintainance window (Managed Automation)Update RDS performance insights (Managed Automation)Create security group (Managed Automation) @@ -17 +17 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Delete NAT gateway (Review Required) + * Delete NAT gateway (Managed Automation) @@ -23 +23 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Delete target groups (review required) + * Delete target groups (Managed Automation) @@ -33 +33 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Create IAM entity or policy (review required) + * Create IAM entity or policy (Managed Automation) @@ -41 +41 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Delete EBS snapshot (Review Required) + * Delete EBS snapshot (Managed Automation) @@ -53 +53 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Migrate AWS Managed Account DNS resolver to Route 53 for SALZ accounts (review required) + * Migrate AWS Managed Account DNS resolver to Route 53 for SALZ accounts (Managed Automation) @@ -61 +61 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Deploy AMS pattern (review required) + * Deploy AMS pattern (Managed Automation) @@ -67 +67 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Override Stack Access Duration (Review required) + * Override Stack Access Duration (Managed automation) @@ -71 +71 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Add VPC static route (review required) + * Add VPC static route (Managed Automation) @@ -97 +97 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Updating an application account (review required) + * Updating an application account (Managed Automation) @@ -99 +99 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Associate private IP addresses (review required) ct-1pvlhug439gl2 + * Associate private IP addresses (Managed Automation) ct-1pvlhug439gl2 @@ -101 +101 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Create Amazon RDS option group (review required) + * Create Amazon RDS option group (Managed Automation) @@ -105 +105 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Create for WIGS (Review Required) + * Create for WIGS (Managed Automation) @@ -109 +109 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Update AWS Backup plan (review required) + * Update AWS Backup plan (Managed Automation) @@ -125 +125 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Update the DeleteOnTermination option (review required) + * Update the DeleteOnTermination option (Managed Automation) @@ -127 +127 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Update RDS maintainance window (review required) + * Update RDS maintainance window (Managed Automation) @@ -129 +129 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Update RDS performance insights (review required) + * Update RDS performance insights (Managed Automation) @@ -131 +131 @@ Create a DHCP option setCreate ELB Listener RuleUpdate VPC Endpoint PolicyDelete - * Create security group (review required) + * Create security group (Managed Automation) @@ -494 +494 @@ You receive the ID of the new RFC in the response and can use it to submit and m -This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a "review required" change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. +This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a manual change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. @@ -496 +496 @@ This is a manual change type (an AMS operator must review and run the CT), which -## Delete NAT gateway (Review Required) +## Delete NAT gateway (Managed Automation) @@ -591 +591 @@ You receive the ID of the new RFC in the response and can use it to submit and m -This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a "review required" change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. +This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a manual change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. @@ -793 +793 @@ You receive the ID of the new RFC in the response and can use it to submit and m -## Delete target groups (review required) +## Delete target groups (Managed Automation) @@ -888 +888 @@ You receive the ID of the new RFC in the response and can use it to submit and m -This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a "review required" change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. +This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a manual change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. @@ -1346 +1346 @@ This is a large provisioning of resources, especially if you add UserData. The l -## Create IAM entity or policy (review required) +## Create IAM entity or policy (Managed Automation) @@ -1471 +1471 @@ You receive the ID of the new RFC in the response and can use it to submit and m - * This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a "review required" change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. + * This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a manual change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. @@ -1781 +1781 @@ You receive the ID of the new RFC in the response and can use it to submit and m -## Delete EBS snapshot (Review Required) +## Delete EBS snapshot (Managed Automation) @@ -1835 +1835 @@ Issue the create RFC command with execution parameters provided inline (escape q - aws amscm create-rfc --change-type-id "ct-1vrnixswq1uwf" --change-type-version "1.0" --title "Delete EBS Snapshot (Review Required)" --execution-parameters "{\"SnapshotIds\": [\"snap-0a1b2c3d4e5f67890\",\"snap-1a2b3c4d5e6f78901\"], \"AMI\": \"No\", \"Region\": \"us-east-1\", \"Priority\": \"Medium\"}" + aws amscm create-rfc --change-type-id "ct-1vrnixswq1uwf" --change-type-version "1.0" --title "Delete EBS Snapshot (managed automation)" --execution-parameters "{\"SnapshotIds\": [\"snap-0a1b2c3d4e5f67890\",\"snap-1a2b3c4d5e6f78901\"], \"AMI\": \"No\", \"Region\": \"us-east-1\", \"Priority\": \"Medium\"}" @@ -2362 +2362 @@ You receive the ID of the new RFC in the response and can use it to submit and m -## Migrate AWS Managed Account DNS resolver to Route 53 for SALZ accounts (review required) +## Migrate AWS Managed Account DNS resolver to Route 53 for SALZ accounts (Managed Automation) @@ -2458 +2458 @@ You receive the ID of the new RFC in the response and can use it to submit and m -This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a "review required" change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. +This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a manual change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. @@ -2754 +2754 @@ You receive the ID of the new RFC in the response and can use it to submit and m -## Deploy AMS pattern (review required) +## Deploy AMS pattern (Managed Automation) @@ -3060 +3060 @@ For information about Directory Service, see the [Directory Service Admin Guide] -## Override Stack Access Duration (Review required) +## Override Stack Access Duration (Managed automation) @@ -3204 +3204 @@ Issue the create RFC command with execution parameters provided inline (escape q - aws amscm create-rfc --change-type-id "ct-1706xvvk6j9hf" --change-type-version "1.0" --title "Enable (review required)" --execution-parameters "{\"SAMLIdentityProviderArns\": [\"arn:aws:iam::123456789012:saml-provider/customer-saml\"], \"IamEntityArns\": [\"arn:aws:iam::123456789012:role/test-role-one\", \"arn:aws:iam::123456789012:role/test-role-two\"], \"Priority\": \"High\"}" + aws amscm create-rfc --change-type-id "ct-1706xvvk6j9hf" --change-type-version "1.0" --title "Enable (managed automation)" --execution-parameters "{\"SAMLIdentityProviderArns\": [\"arn:aws:iam::123456789012:saml-provider/customer-saml\"], \"IamEntityArns\": [\"arn:aws:iam::123456789012:role/test-role-one\", \"arn:aws:iam::123456789012:role/test-role-two\"], \"Priority\": \"High\"}" @@ -3241 +3241 @@ You receive the ID of the new RFC in the response and can use it to submit and m -## Add VPC static route (review required) +## Add VPC static route (Managed Automation) @@ -4628 +4628 @@ To learn more about Amazon S3, see [Amazon Simple Storage Service Documentation] -## Updating an application account (review required) +## Updating an application account (Managed Automation) @@ -4733 +4733 @@ To create an additional public subnet in a new availability zone (AZ), a private -## Associate private IP addresses (review required) ct-1pvlhug439gl2 +## Associate private IP addresses (Managed Automation) ct-1pvlhug439gl2 @@ -4828 +4828 @@ If needed, see [EC2 instance stack create fail](https://docs.aws.amazon.com/mana -## Create Amazon RDS option group (review required) +## Create Amazon RDS option group (Managed Automation) @@ -4832 +4832 @@ Screenshot of this change type in the AMS console: - + @@ -4882 +4882 @@ Issue the create RFC command with execution parameters provided inline (escape q - aws amscm create-rfc --change-type-id "ct-10yi1sd9nst1c" --change-type-version "1.0" --title "Create option group (review required)" --execution-parameters "{\"OptionGroupName\": \"CreatingTheOptionGroup\", \"Description\": \"RDS option group\", \"EngineName\": \"sqlserver-ee\", \"MajorEngineVersion\": \"10.01\", \"DBInstanceName\": \"database-1\", \"Priority\": \"Medium\"}" + aws amscm create-rfc --change-type-id "ct-10yi1sd9nst1c" --change-type-version "1.0" --title "Create option group (managed automation)" --execution-parameters "{\"OptionGroupName\": \"CreatingTheOptionGroup\", \"Description\": \"RDS option group\", \"EngineName\": \"sqlserver-ee\", \"MajorEngineVersion\": \"10.01\", \"DBInstanceName\": \"database-1\", \"Priority\": \"Medium\"}" @@ -5026 +5026 @@ To learn more about AMS multi-account landing zones, see [AWS Managed Services ( -## Create for WIGS (Review Required) +## Create for WIGS (Managed Automation) @@ -5247 +5247 @@ To learn more about Amazon EBS, see [Amazon Elastic Block Store (EBS)](https://a -## Update AWS Backup plan (review required) +## Update AWS Backup plan (Managed Automation) @@ -6101 +6101 @@ For more information about Amazon EC2, including size recommendations, see [Amaz -## Update the DeleteOnTermination option (review required) +## Update the DeleteOnTermination option (Managed Automation) @@ -6199 +6199 @@ To learn more about Amazon EC2, including size recommendations, see [Amazon Elas -## Update RDS maintainance window (review required) +## Update RDS maintainance window (Managed Automation) @@ -6297 +6297 @@ To learn more about Amazon RDS, including size recommendations, see [Amazon Rela -## Update RDS performance insights (review required) +## Update RDS performance insights (Managed Automation) @@ -6399 +6399 @@ To update an RDS stack for Aurora, see [RDS Database Stack | Update](https://doc -## Create security group (review required) +## Create security group (Managed Automation) @@ -6512 +6512 @@ Outbound rules are not required; however, if they are not specified, then a "127 -This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a "review required" change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically. +This is a manual change type (an AMS operator must review and run the CT), which means that the RFC can take longer to run and you might have to communicate with AMS through the RFC details page correspondance option. Additionally, if you schedule a manual change type RFC, be sure to allow at least 24 hours, if approval does not happen before the scheduled start time, the RFC is rejected automatically.