AWS cli medium security documentation change

Service: cli · 2025-11-19 · Security-related medium

File: cli/latest/reference/logs/put-resource-policy.md

Summary

Added policy restrictions and warnings about non-AWS service principal enforcement

Security assessment

Explicitly warns about unenforced policies for non-AWS principals and adds security controls documentation. This addresses potential misconfiguration risks by clarifying policy enforcement boundaries.

Diff

diff --git a/cli/latest/reference/logs/put-resource-policy.md b/cli/latest/reference/logs/put-resource-policy.md
index 0071f63ac..c01c79761 100644
--- a//cli/latest/reference/logs/put-resource-policy.md
+++ b//cli/latest/reference/logs/put-resource-policy.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.37 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.39 Command Reference](../../index.html) »
@@ -59 +59,11 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c
-Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53. An account can have up to 10 resource policies per Amazon Web Services Region.
+Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53. This API has the following restrictions:
+
+  * **Supported actions** \- Policy only supports `logs:PutLogEvents` and `logs:CreateLogStream` actions
+  * **Supported principals** \- Policy only applies when operations are invoked by Amazon Web Services service principals (not IAM users, roles, or cross-account principals
+  * **Policy limits** \- An account can have a maximum of 10 policies without resourceARN and one per LogGroup resourceARN
+
+
+
+### Warning
+
+Resource policies with actions invoked by non-Amazon Web Services service principals (such as IAM users, roles, or other Amazon Web Services accounts) will not be enforced. For access control involving these principals, use the IAM policies.
@@ -305 +315 @@ revisionId -> (string)
-  * [AWS CLI 2.31.37 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.39 Command Reference](../../index.html) »