AWS AmazonCloudWatch documentation change
Summary
Expanded documentation for rum:alias context key usage, adding mobile app SDK requirements and restructuring policy examples
Security assessment
The changes clarify security controls for RUM resource policies using rum:alias context key, but there's no evidence of addressing a specific vulnerability. The update enhances documentation about existing security features (request filtering based on aliases)
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-resource-policies.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-resource-policies.md index 45277487b..c13484cce 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-resource-policies.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-resource-policies.md @@ -78 +78 @@ JSON -Additionally, you can also choose to only accept [PutRumEvents](https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_PutRumevents.html) requests that are signed with a certain alias using the `rum:alias` service context key. In the following example, `PutRumEvents` will have to set the optional `Alias` request parameter to either `alias1` or `alias2` for the event to be accepted. To configure your web client to send `Alias` you must use version 1.20 or later of the CloudWatch RUM web client, as described in [ Application-specific Configurations](https://github.com/aws-observability/aws-rum-web/blob/main/docs/configuration.md) on GitHub. +Additionally, you can use the `rum:alias` service context key to control which requests are accepted. @@ -80 +80,7 @@ Additionally, you can also choose to only accept [PutRumEvents](https://docs.aws -JSON +For web app monitors, you must configure your web client to send `Alias` using version 1.20 or later of the CloudWatch RUM web client, as described in [ Application-specific Configurations](https://github.com/aws-observability/aws-rum-web/blob/main/docs/configuration.md) on GitHub. + +For mobile app monitors, you must configure your instrumentation according to the SDK. + + * iOS applications use the [AWS Distro for OpenTelemetry (ADOT) iOS SDK](https://github.com/aws-observability/aws-otel-swift). + + * Android applications use the [AWS Distro for OpenTelemetry (ADOT) Android SDK](https://github.com/aws-observability/aws-otel-android). @@ -83 +88,0 @@ JSON -**** @@ -85,0 +91,2 @@ JSON +In the following example, the resource policy requires that requests must contain either `alias1` or `alias2` for the event to be accepted. + @@ -98,4 +105 @@ JSON - "aws:SourceAccount": "123456789012" - }, - "ArnLike": { - "aws:SourceArn": "arn:aws:rum:us-east-1:123456789012:appmonitor/MyApplication" + "rum:alias":["alias1", "alias2"]