AWS step-functions medium security documentation change
Summary
Updated IAM role trust policy examples with concrete ARNs and removed EventBridge permissions note
Security assessment
Specific ARN formatting and removal of unnecessary permissions guidance improves least-privilege practices. The sts:ExternalId condition using state machine ARN enhances role assumption security by tying permissions to specific resources.
Diff
diff --git a/step-functions/latest/dg/concepts-access-cross-acct-resources.md b/step-functions/latest/dg/concepts-access-cross-acct-resources.md index dc9d803e0..05d023cf2 100644 --- a//step-functions/latest/dg/concepts-access-cross-acct-resources.md +++ b//step-functions/latest/dg/concepts-access-cross-acct-resources.md @@ -93,0 +94,3 @@ Update the trust policy of your target IAM role as shown in the following exampl +**** + + @@ -102 +105 @@ Update the trust policy of your target IAM role as shown in the following exampl - "AWS": "arn:aws:iam::sourceAccountID:role/InvokeRole", + "AWS": "arn:aws:iam::123456789012:role/InvokeRole" @@ -106 +109 @@ Update the trust policy of your target IAM role as shown in the following exampl - "sts:ExternalId": "arn:aws:states:us-east-2:sourceAccountID:stateMachine:stateMachineName" + "sts:ExternalId": "arn:aws:states:us-east-2:123456789012:stateMachine:stateMachineName" @@ -115 +119 @@ Update the trust policy of your target IAM role as shown in the following exampl -To grant the permissions required for your state machine, update the required permissions for the target IAM role. For more information, see [How Step Functions generates IAM policies for integrated services](./service-integration-iam-templates.html). The Amazon EventBridge permissions from the example policies aren't required. For example, to start a state machine, add the following permissions. +To grant the permissions required for your state machine, update the required permissions for the target IAM role. For more information, see [How Step Functions generates IAM policies for integrated services](./service-integration-iam-templates.html). For example, to start a state machine, add the following permissions.