AWS resource-explorer documentation change
Summary
Updated resource discovery workflow, removed Region activation requirements, added IAM permission requirements for Unified Search
Security assessment
Adds explicit IAM permission requirements for Unified Search (AWSResourceExplorerReadOnlyAccess) and clarifies access resolution paths. While not fixing a vulnerability, this enhances security documentation by specifying minimum permissions and access escalation procedures. The removal of Region activation requirements reflects product changes, not security fixes.
Diff
diff --git a/resource-explorer/latest/userguide/troubleshooting_search.md b/resource-explorer/latest/userguide/troubleshooting_search.md index 5a9c3f5a8..ada3c3baf 100644 --- a//resource-explorer/latest/userguide/troubleshooting_search.md +++ b//resource-explorer/latest/userguide/troubleshooting_search.md @@ -7,2 +6,0 @@ Why are some resources missing from my Resource Explorer search results?Why are -AWS Resource Explorer now provides immediate access to resource search and discovery capabilities in a Region. With this launch, you no longer need to activate Resource Explorer to discover your resources. [Learn more](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-immediate-resource-discovery-experience.html) - @@ -35 +33 @@ The following list provides reasons why some resources might not appear in your -After you initially turn on Resource Explorer in an AWS Region, it can take up to 36 hours for indexing and replication to the aggregator index to complete. Try your search again later. +After you first access Resource Explorer, the service automatically enables search capabilities [based on your IAM permissions](./manage-immediate-resource-discovery-experience.html). It can then take up to 36 hours for indexing and replication to the aggregator index to complete. Try your search again later. @@ -47,5 +44,0 @@ It can take some time for details about a new resource discovered in one Region -**The Region with the resource doesn't have Resource Explorer turned on** - - -Your administrator determines which AWS Regions that Resource Explorer can operate in. The **[Settings](https://console.aws.amazon.com/resource-explorer/home#/settings)** page shows which Regions have Resource Explorer turned on and contain an index. If the Region with your resource is not turned on, ask your administrator to turn on Resource Explorer in that Region. - @@ -67 +60 @@ Some resource types aren't supported by Resource Explorer. For more information, -**Indexes or views aren't configured in the console Region** +**User indexes aren't configured in the console Region** @@ -70 +63 @@ Some resource types aren't supported by Resource Explorer. For more information, -If the indexes or views aren't configured in the Regions expected by the console consuming the widget, you will not see the results you expect. For more information, see [Enabling cross-Region search by creating an aggregator index](./manage-aggregator-region.html). +If a user index isn't configured in a Region, you will see partial results. For more information, see [Understanding the immediate resource discovery experience](./manage-immediate-resource-discovery-experience.html). @@ -135,10 +128 @@ If your query includes free-form text, the Resource Explorer console will use th -[Unified Search](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/using-search.html) results are available in the search bar at the top of every AWS Management Console page. However, the search can return resources that match the query in search results _only_ after the following configuration options are complete: - - * There must be [an aggregator index](./manage-aggregator-region-turn-on.html) in one of the Regions in the account. - - * There must be [a default view in the Region that contains the aggregator index](./configure-views-set-default.html). - - * All principals (IAM roles and users) must have [permission to search using that default view](./configure-views-grant-access.html). - - - +[Unified Search](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/using-search.html) results are available in the search bar at the top of every AWS Management Console page when you have, at minimum, the permissions in the `AWSResourceExplorerReadOnlyAccess` managed policy. If you don't have access to resource results, obtain permission from your administrator or sign in with a role that has this permission.