AWS autoscaling documentation change
Summary
Updated terminology from 'Auto Scaling groups' to 'Amazon EC2 Auto Scaling groups' throughout the document for consistency. No functional changes to permissions or security policies.
Security assessment
Changes are purely terminological updates (e.g., 'Auto Scaling groups' → 'Amazon EC2 Auto Scaling groups'). No modifications to permission policies, condition keys, or security recommendations. No evidence of vulnerability fixes or new security guidance.
Diff
diff --git a/autoscaling/ec2/userguide/ec2-auto-scaling-launch-template-permissions.md b/autoscaling/ec2/userguide/ec2-auto-scaling-launch-template-permissions.md index efad118af..777306fcf 100644 --- a//autoscaling/ec2/userguide/ec2-auto-scaling-launch-template-permissions.md +++ b//autoscaling/ec2/userguide/ec2-auto-scaling-launch-template-permissions.md @@ -7 +7 @@ Require launch templates that have a specific tagRequire a launch template and a -# Control Amazon EC2 launch template usage in Auto Scaling groups +# Control Amazon EC2 launch template usage in Amazon EC2 Auto Scaling groups @@ -9 +9 @@ Require launch templates that have a specific tagRequire a launch template and a -Amazon EC2 Auto Scaling supports using Amazon EC2 launch templates with your Auto Scaling groups. We recommend that you allow users to create Auto Scaling groups from launch templates, because doing so allows them to use the latest features of Amazon EC2 Auto Scaling and Amazon EC2. For example, users must specify a launch template to use a [mixed instances policy](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_MixedInstancesPolicy.html). +Amazon EC2 Auto Scaling supports using Amazon EC2 launch templates with your Amazon EC2 Auto Scaling groups. We recommend that you allow users to create Amazon EC2 Auto Scaling groups from launch templates, because doing so allows them to use the latest features of Amazon EC2 Auto Scaling and Amazon EC2. For example, users must specify a launch template to use a [mixed instances policy](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_MixedInstancesPolicy.html). @@ -15 +15 @@ You can use the `AmazonEC2FullAccess` policy to give users complete access to wo -The following shows an example of a basic permissions policy that you can tailor for your own use. The policy grants permissions to create, update, and delete all Auto Scaling groups, but only if the group uses the tag ``purpose=testing``. It then gives permission for all `Describe` actions. Because `Describe` actions do not support resource-level permissions, you must specify them in a separate statement without conditions. +The following shows an example of a basic permissions policy that you can tailor for your own use. The policy grants permissions to create, update, and delete all Amazon EC2 Auto Scaling groups, but only if the group uses the tag ``purpose=testing``. It then gives permission for all `Describe` actions. Because `Describe` actions do not support resource-level permissions, you must specify them in a separate statement without conditions. @@ -17 +17 @@ The following shows an example of a basic permissions policy that you can tailor -IAM identities (users or roles) with this policy have permission to create or update an Auto Scaling group using a launch template because they're also given permission to use the `ec2:RunInstances` action. +IAM identities (users or roles) with this policy have permission to create or update an Amazon EC2 Auto Scaling group using a launch template because they're also given permission to use the `ec2:RunInstances` action. @@ -53 +53 @@ JSON -Users who create or update Auto Scaling groups might need some related permissions, such as: +Users who create or update Amazon EC2 Auto Scaling groups might need some related permissions, such as: @@ -64 +64 @@ Users who create or update Auto Scaling groups might need some related permissio -These permissions for actions to be completed when launching instances are checked when the user interacts with an Auto Scaling group. For more information, see Permissions validation for ec2:RunInstances and iam:PassRole. +These permissions for actions to be completed when launching instances are checked when the user interacts with an Amazon EC2 Auto Scaling group. For more information, see Permissions validation for ec2:RunInstances and iam:PassRole. @@ -99 +99 @@ For more information about using tag-based policies with launch templates, see [ -You can also use IAM permissions to enforce that a launch template and the version number of the launch template must be specified when creating or updating Auto Scaling groups. +You can also use IAM permissions to enforce that a launch template and the version number of the launch template must be specified when creating or updating Amazon EC2 Auto Scaling groups. @@ -101 +101 @@ You can also use IAM permissions to enforce that a launch template and the versi -The following example allows users to create and update Auto Scaling groups only if a launch template and the version number of the launch template are specified. If users with this policy omit the version number to specify either the `$Latest` or `$Default` launch template version, or attempt to use a launch configuration instead, the action fails. +The following example allows users to create and update Amazon EC2 Auto Scaling groups only if a launch template and the version number of the launch template are specified. If users with this policy omit the version number to specify either the `$Latest` or `$Default` launch template version, or attempt to use a launch configuration instead, the action fails. @@ -170 +170 @@ JSON -To force replacement Auto Scaling instances to launch that use a new launch template or a new version of a launch template with the instance metadata options configured, you can start an instance refresh. For more information, see [Update Auto Scaling instances](./update-auto-scaling-group.html#update-auto-scaling-instances). +To force replacement Amazon EC2 Auto Scaling instances to launch that use a new launch template or a new version of a launch template with the instance metadata options configured, you can start an instance refresh. For more information, see [Update Amazon EC2 Auto Scaling instances](./update-auto-scaling-group.html#update-auto-scaling-instances). @@ -275 +275 @@ The following example allows users to tag instances and volumes on creation. Thi -You must give your console users permissions for the `ec2:DescribeLaunchTemplates` and `ec2:DescribeLaunchTemplateVersions` actions. Without these permissions, launch template data cannot load in the Auto Scaling group wizard, and users cannot step through the wizard to launch instances using a launch template. You can specify these additional actions in the `Action` element of an IAM policy statement. +You must give your console users permissions for the `ec2:DescribeLaunchTemplates` and `ec2:DescribeLaunchTemplateVersions` actions. Without these permissions, launch template data cannot load in the Amazon EC2 Auto Scaling group wizard, and users cannot step through the wizard to launch instances using a launch template. You can specify these additional actions in the `Action` element of an IAM policy statement. @@ -279 +279 @@ You must give your console users permissions for the `ec2:DescribeLaunchTemplate -Users can specify which version of a launch template their Auto Scaling group uses. Depending on their permissions, this can be a specific numbered version, or the `$Latest` or `$Default` version of the launch template. If it's the latter, take special care. This may override permissions for `ec2:RunInstances` and `iam:PassRole` that you intended to restrict. +Users can specify which version of a launch template their Amazon EC2 Auto Scaling group uses. Depending on their permissions, this can be a specific numbered version, or the `$Latest` or `$Default` version of the launch template. If it's the latter, take special care. This may override permissions for `ec2:RunInstances` and `iam:PassRole` that you intended to restrict. @@ -281 +281 @@ Users can specify which version of a launch template their Auto Scaling group us -This section explains the scenario of using the latest or default version of the launch template with an Auto Scaling group. +This section explains the scenario of using the latest or default version of the launch template with an Amazon EC2 Auto Scaling group. @@ -287 +287 @@ After the initial verification and request are complete, whenever instances laun -Use the `autoscaling:LaunchTemplateVersionSpecified` condition key if you want to limit who has access to configuring groups to use the `$Latest` or `$Default` version. This ensures that the Auto Scaling group only accepts a specific numbered version when a user calls the `CreateAutoScalingGroup` and `UpdateAutoScalingGroup` APIs. For an example that shows how to add this condition key to an IAM policy, see Require a launch template and a version number. +Use the `autoscaling:LaunchTemplateVersionSpecified` condition key if you want to limit who has access to configuring groups to use the `$Latest` or `$Default` version. This ensures that the Amazon EC2 Auto Scaling group only accepts a specific numbered version when a user calls the `CreateAutoScalingGroup` and `UpdateAutoScalingGroup` APIs. For an example that shows how to add this condition key to an IAM policy, see Require a launch template and a version number. @@ -289 +289 @@ Use the `autoscaling:LaunchTemplateVersionSpecified` condition key if you want t -For Auto Scaling groups that are configured to use the `$Latest` or `$Default` launch template version, consider limiting who can create and manage versions of the launch template, including the `ec2:ModifyLaunchTemplate` action that allows a user to specify the default launch template version. For more information, see [Control versioning permissions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/permissions-for-launch-templates.html#permissions-for-launch-template-versions) in the _Amazon EC2 User Guide_. +For Amazon EC2 Auto Scaling groups that are configured to use the `$Latest` or `$Default` launch template version, consider limiting who can create and manage versions of the launch template, including the `ec2:ModifyLaunchTemplate` action that allows a user to specify the default launch template version. For more information, see [Control versioning permissions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/permissions-for-launch-templates.html#permissions-for-launch-template-versions) in the _Amazon EC2 User Guide_.