AWS r53recovery documentation change

Service: r53recovery · 2025-11-07 · Documentation low

File: r53recovery/latest/dg/security-iam-awsmanpol-routing.md

Summary

Added documentation for new AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy with detailed permissions

Security assessment

This change documents a new AWS managed policy that grants specific permissions for Region switch plan operations and IAM policy simulation. While this is security documentation (IAM permissions), there is no indication it addresses a specific security vulnerability. The policy appears to enable new functionality rather than patch a security issue.

Diff

diff --git a/r53recovery/latest/dg/security-iam-awsmanpol-routing.md b/r53recovery/latest/dg/security-iam-awsmanpol-routing.md
index ab83aa159..1112b9513 100644
--- a//r53recovery/latest/dg/security-iam-awsmanpol-routing.md
+++ b//r53recovery/latest/dg/security-iam-awsmanpol-routing.md
@@ -5 +5 @@
-AmazonRoute53RecoveryControlConfigFullAccessAmazonRoute53RecoveryControlConfigReadOnlyAccessAmazonRoute53RecoveryClusterFullAccessAmazonRoute53RecoveryClusterReadOnlyAccessPolicy updates
+AmazonRoute53RecoveryControlConfigFullAccessAmazonRoute53RecoveryControlConfigReadOnlyAccessAmazonRoute53RecoveryClusterFullAccessAmazonRoute53RecoveryClusterReadOnlyAccessAmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicyPolicy updates
@@ -42,0 +43,27 @@ To view the permissions for this policy, see [AmazonRoute53RecoveryClusterReadOn
+## AWS managed policy: AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy
+
+You can attach `AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy` to your IAM entities. This policy grants permissions for ARC Region switch plan execution and evaluation. Attach it to IAM roles used for Region switch plan execution.
+
+**Permissions details**
+
+This policy includes the following permissions:
+
+  * `arc-region-switch:GetPlan` – Allows principals to retrieve configuration details for a Region switch plan.
+
+  * `arc-region-switch:GetPlanExecution` – Allows principals to retrieve information about a specific Region switch plan execution.
+
+  * `arc-region-switch:ListPlanExecutions` – Allows principals to list all executions of Region switch plans.
+
+  * `iam:SimulatePrincipalPolicy` – Allows principals to simulate and evaluate what actions an IAM role can perform. This permission is scoped to IAM roles only and is used during plan evaluation to verify that necessary permissions are in place before executing a Region switch plan.
+
+  * `cloudwatch:DescribeAlarms` – Allows principals to retrieve information about Amazon CloudWatch alarms.
+
+  * `cloudwatch:DescribeAlarmHistory` – Allows principals to retrieve historical state changes for Amazon CloudWatch alarms.
+
+  * `cloudwatch:GetMetricStatistics` – Allows principals to retrieve statistical data for Amazon CloudWatch metrics.
+
+
+
+
+To view more details about the policy, including the latest version of the JSON policy document, see [AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy.html) in the _AWS Managed Policy Reference Guide_.
+