AWS lexv2 medium security documentation change
Summary
Updated account setup instructions with security best practices, restructured IAM guidance, added programmatic access details, and removed troubleshooting section
Security assessment
Added explicit security guidance about avoiding root user usage ('As a security best practice...') and emphasized temporary credentials over long-term credentials. Removed references to insecure practices like using root console access. Added warnings about IAM long-term credentials being 'Not recommended'. These changes directly address security posture improvements.
Diff
diff --git a/lexv2/latest/dg/gs-account.md b/lexv2/latest/dg/gs-account.md index 0967a5388..b07f129b3 100644 --- a//lexv2/latest/dg/gs-account.md +++ b//lexv2/latest/dg/gs-account.md @@ -30 +30,7 @@ If you already have an AWS account, skip to the next task. If you don't have an - * To create an AWS account, see [How do I create and activate a new AWS account?](https://portal.aws.amazon.com/gp/aws/developer/registration/index.html) in the AWS Knowledge Center. + 1. Open [https://portal.aws.amazon.com/billing/signup](https://portal.aws.amazon.com/billing/signup). + + 2. Follow the online instructions. + +Part of the sign-up procedure involves receiving a phone call or text message and entering a verification code on the phone keypad. + +When you sign up for an AWS account, an _AWS account root user_ is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to a user, and use only the root user to perform [tasks that require root user access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks). @@ -41 +47 @@ Services in AWS, such as Amazon Lex V2, require that you provide credentials whe -Create an IAM user account to access your account for Amazon Lex V2. For comprehensive guidance on IAM user creation, see [Getting started with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started.html) in the _IAM User Guide_. +Create an IAM user account to access your account for Amazon Lex V2: @@ -65 +71 @@ The Getting Started exercises in this guide assume that you have a user (`adminu -For more information about IAM, see the [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/). +For more information about IAM, see the following: @@ -67 +73 @@ For more information about IAM, see the [IAM User Guide](https://docs.aws.amazon -### Common Setup Issues + * [AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/) @@ -69 +75 @@ For more information about IAM, see the [IAM User Guide](https://docs.aws.amazon -If you encounter issues during account setup, here are common solutions: + * [Getting started with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started.html) @@ -71 +77 @@ If you encounter issues during account setup, here are common solutions: - * **Permission Denied Errors** – Ensure your IAM user has the necessary Amazon Lex V2 permissions. For getting started, administrator permissions are recommended. For detailed information about Amazon Lex V2 permissions, see the Security section in this guide. + * [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/) @@ -73 +78,0 @@ If you encounter issues during account setup, here are common solutions: - * **Console Access Issues** – Make sure you're signing in with the correct IAM user URL for your account, not the root AWS console. For more information about IAM best practices, see the Security section in this guide. @@ -75 +79,0 @@ If you encounter issues during account setup, here are common solutions: - * **Region Availability** – Amazon Lex V2 is not available in all AWS regions. Check the [Amazon Lex endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/lex.html) to confirm availability in your preferred region. For information about supported locales, see [Languages and locales supported by Amazon Lex V2](./how-languages.html). @@ -77 +80,0 @@ If you encounter issues during account setup, here are common solutions: - * **Free Tier Limits** – Monitor your usage to stay within free tier limits: 10,000 text requests and 5,000 speech requests per month. For detailed pricing information, see [Amazon Lex Pricing](https://aws.amazon.com/lex/pricing/). @@ -79 +82 @@ If you encounter issues during account setup, here are common solutions: - * **Quota Limits** – If you encounter service limits, review the current quotas and request increases if needed. For more information, see [Guidelines and best practices](./quotas.html). +## Grant programmatic access @@ -80,0 +84 @@ If you encounter issues during account setup, here are common solutions: +Users need programmatic access if they want to interact with AWS outside of the AWS Management Console. The way to grant programmatic access depends on the type of user that's accessing AWS. @@ -81,0 +86 @@ If you encounter issues during account setup, here are common solutions: +To grant users programmatic access, choose one of the following options. @@ -82,0 +88,3 @@ If you encounter issues during account setup, here are common solutions: +Which user needs programmatic access? | To | By +---|---|--- +Workforce identity (Users managed in IAM Identity Center) | Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. @@ -84 +92,2 @@ If you encounter issues during account setup, here are common solutions: -For additional troubleshooting help, see the Monitoring section in this guide for information about error logs and debugging. + * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com/sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. @@ -86 +94,0 @@ For additional troubleshooting help, see the Monitoring section in this guide fo -## Grant programmatic access @@ -88 +96,6 @@ For additional troubleshooting help, see the Monitoring section in this guide fo -For information about how to get your access key ID and secret access key, see [Understanding and getting your AWS credentials](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) in the AWS General Reference. +IAM | Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions in [Using temporary credentials with AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html) in the _IAM User Guide_. +IAM | (Not recommended)Use long-term credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. + + * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com/sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. + * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. @@ -90 +102,0 @@ For information about how to get your access key ID and secret access key, see [ -### Developer Environment Setup @@ -92 +103,0 @@ For information about how to get your access key ID and secret access key, see [ -**For Developers:** If you plan to use the AWS CLI or SDKs, you'll also want to configure your development environment. Install the AWS CLI and configure it with your access keys. For detailed instructions, see [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). For SDK examples, see [Bot examples](./examples.html).