AWS keyspaces documentation change
Summary
Consolidated permissions documentation to recommend using the AWS managed policy `AmazonKeyspacesFullAccess` for autoscaling management, removed granular IAM policy examples, and added step-by-step instructions for attaching the policy.
Security assessment
The change emphasizes using AWS managed policies for security best practices but does not address a specific security vulnerability. The addition of a note about requiring `application-autoscaling:*` permissions to disable auto scaling before deletion improves procedural clarity but does not indicate a resolved security flaw.
Diff
diff --git a/keyspaces/latest/devguide/autoscaling.permissions.md b/keyspaces/latest/devguide/autoscaling.permissions.md index 014265bdc..ac1b36b20 100644 --- a//keyspaces/latest/devguide/autoscaling.permissions.md +++ b//keyspaces/latest/devguide/autoscaling.permissions.md @@ -5,2 +4,0 @@ -Create permissionsUpdatee permissionsView permissionsDelete permissions - @@ -9,26 +7 @@ Create permissionsUpdatee permissionsView permissionsDelete permissions -To configure the required permissions to create and manage automatic scaling settings for tables in Amazon Keyspaces, you can use the following AWS Identity and Access Management (IAM) policies. - -## Permissions to create a table with autoscaling enabled - -To create a new table with autoscaling enabled, the principal needs `CREATE` and `ALTER` permissions for tables. - -The following IAM policy is an example of this. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "cassandra:Create", - "cassandra:Alter" - ] - "Resource": [ - "arn:aws:cassandra:aws-region:111122223333:/keyspace/my_keyspace/table/my_table" - ] - } - ] - } - -## Permissions to update autoscaling settings of a table +To get started, confirm that the principal has the appropriate permissions to create and manage automatic scaling settings. In AWS Identity and Access Management (IAM), the AWS managed policy `AmazonKeyspacesFullAccess` is required to manage Amazon Keyspaces scaling policies. @@ -36,19 +9 @@ The following IAM policy is an example of this. -To update the autoscaling settings of a table, the principal needs `ALTER` permissions for tables. - -The following IAM policy is an example of this. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "cassandra:Alter" - ] - "Resource": [ - "arn:aws:cassandra:aws-region:111122223333:/keyspace/my_keyspace/table/my_table" - ] - } - ] - } +###### Important @@ -56 +11 @@ The following IAM policy is an example of this. -## Permissions to view autoscaling settings +`application-autoscaling:*` permissions are required to disable automatic scaling on a table. You must turn off auto scaling for a table before you can delete it. @@ -58 +13 @@ The following IAM policy is an example of this. -To view or list tables and autoscaling settings, the principal needs read permissions for the system keyspace. For more information, see [system_schema_mcs](./working-with-keyspaces.html#keyspace_system_schema_mcs). +To set up an IAM user or role for Amazon Keyspaces console access and Amazon Keyspaces automatic scaling, add the following policy. @@ -60 +15 @@ To view or list tables and autoscaling settings, the principal needs read permis -The following IAM policy is an example of this. +###### To attach the `AmazonKeyspacesFullAccess` policy @@ -61,0 +17 @@ The following IAM policy is an example of this. + 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). @@ -63,12 +19 @@ The following IAM policy is an example of this. - { - "Version":"2012-10-17", - "Statement":[ - { - "Effect":"Allow", - "Action":"cassandra:Select", - "Resource":[ - "arn:aws:cassandra:aws-region:111122223333:/keyspace/system*" - ] - } - ] - } + 2. On the IAM console dashboard, choose **Users** , and then choose your IAM user or role from the list. @@ -76 +21 @@ The following IAM policy is an example of this. -## Permissions to delete a table with autoscaling enabled + 3. On the **Summary** page, choose **Add permissions**. @@ -78 +23 @@ The following IAM policy is an example of this. -To delete a table with autoscaling enabled, the principal needs permissions for the `Drop` action for the specified table. + 4. Choose **Attach existing policies directly**. @@ -80 +25 @@ To delete a table with autoscaling enabled, the principal needs permissions for -The following IAM policy is an example of this. + 5. From the list of policies, choose **AmazonKeyspacesFullAccess** , and then choose **Next: Review**. @@ -82 +27 @@ The following IAM policy is an example of this. -###### Important + 6. Choose **Add permissions**. @@ -84 +28,0 @@ The following IAM policy is an example of this. -`application-autoscaling:*` permissions are required to disable automatic scaling on a table. You must turn off auto scaling for a table before you can delete it. @@ -87,12 +30,0 @@ The following IAM policy is an example of this. - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "cassandra:Drop", - "Resource": [ - "arn:aws:cassandra:aws-region:111122223333:/keyspace/my_keyspace/table/my_table" - ] - } - ] - }