AWS IAM documentation change
Summary
Updated service name references from 'AWS CloudFormation' to 'CloudFormation' in multiple sections for consistency
Security assessment
The changes are purely stylistic/naming convention updates (removing 'AWS' prefix from CloudFormation references). No security vulnerabilities, mitigations, or security feature enhancements are mentioned or implied in the changes.
Diff
diff --git a/IAM/latest/UserGuide/reference_policies_condition-keys.md b/IAM/latest/UserGuide/reference_policies_condition-keys.md index b74c72d85..86b37349d 100644 --- a//IAM/latest/UserGuide/reference_policies_condition-keys.md +++ b//IAM/latest/UserGuide/reference_policies_condition-keys.md @@ -608 +608 @@ IAM user access keys are long-term credentials, but in some cases, AWS creates t - * If an IAM user makes a call to an AWS service, the service re-uses the user's credentials to make another request to a different service. For example, when calling Athena to access an Amazon S3 bucket, or when using AWS CloudFormation to create an Amazon EC2 instance. For the subsequent request, AWS uses temporary credentials. + * If an IAM user makes a call to an AWS service, the service re-uses the user's credentials to make another request to a different service. For example, when calling Athena to access an Amazon S3 bucket, or when using CloudFormation to create an Amazon EC2 instance. For the subsequent request, AWS uses temporary credentials. @@ -2019 +2019 @@ To allow or deny access when _any_ service makes a request using the principal's -The `aws:CalledVia` key is a [multivalued key](./reference_policies_condition-single-vs-multi-valued-context-keys.html). However, you can't enforce order using this key in a condition. Using the example above, **User 1** makes a request to AWS CloudFormation, which calls DynamoDB, which calls AWS KMS. These are three separate requests. The final call to AWS KMS is performed by User 1 _via_ AWS CloudFormation and then DynamoDB. +The `aws:CalledVia` key is a [multivalued key](./reference_policies_condition-single-vs-multi-valued-context-keys.html). However, you can't enforce order using this key in a condition. Using the example above, **User 1** makes a request to CloudFormation, which calls DynamoDB, which calls AWS KMS. These are three separate requests. The final call to AWS KMS is performed by User 1 _via_ CloudFormation and then DynamoDB. @@ -2060 +2060 @@ JSON -If you want to enforce which service makes the first or last call in the chain, you can use the `aws:CalledViaFirst` and `aws:CalledViaLast` keys. For example, the following policy allows managing the key named `my-example-key` in AWS KMS. These AWS KMS operations are allowed only if multiple requests were included in the chain. The first request must be made via AWS CloudFormation and the last via DynamoDB. If other services make requests in the middle of the chain, the operation is still allowed. +If you want to enforce which service makes the first or last call in the chain, you can use the `aws:CalledViaFirst` and `aws:CalledViaLast` keys. For example, the following policy allows managing the key named `my-example-key` in AWS KMS. These AWS KMS operations are allowed only if multiple requests were included in the chain. The first request must be made via CloudFormation and the last via DynamoDB. If other services make requests in the middle of the chain, the operation is still allowed. @@ -2094 +2094 @@ JSON -The `aws:CalledViaFirst` and `aws:CalledViaLast` keys are present in the request when a service uses an IAM principal's credentials to call another service. They indicate the first and last services that made calls in the chain of requests. For example, assume that AWS CloudFormation calls another service named `X Service`, which calls DynamoDB, which then calls AWS KMS. The final call to AWS KMS is performed by `User 1` _via_ AWS CloudFormation, then `X Service`, and then DynamoDB. It was first called via AWS CloudFormation and last called via DynamoDB. +The `aws:CalledViaFirst` and `aws:CalledViaLast` keys are present in the request when a service uses an IAM principal's credentials to call another service. They indicate the first and last services that made calls in the chain of requests. For example, assume that CloudFormation calls another service named `X Service`, which calls DynamoDB, which then calls AWS KMS. The final call to AWS KMS is performed by `User 1` _via_ CloudFormation, then `X Service`, and then DynamoDB. It was first called via CloudFormation and last called via DynamoDB.