AWS autoscaling documentation change
Summary
Updated terminology from 'Auto Scaling groups' to 'Amazon EC2 Auto Scaling groups' throughout the document for consistency and clarity. Also updated related link text accordingly.
Security assessment
The changes are purely terminological updates without modifying any security policies, permissions, or vulnerability mitigations. No evidence of addressing specific security vulnerabilities or weaknesses exists in the diff.
Diff
diff --git a/autoscaling/ec2/userguide/security_iam_id-based-policy-examples.md b/autoscaling/ec2/userguide/security_iam_id-based-policy-examples.md index 721fcebfc..2acda39c3 100644 --- a//autoscaling/ec2/userguide/security_iam_id-based-policy-examples.md +++ b//autoscaling/ec2/userguide/security_iam_id-based-policy-examples.md @@ -5 +5 @@ -Control the size of the Auto Scaling groups that can be createdControl which tag keys and tag values can be usedControl which Auto Scaling groups can be deletedControl which scaling policies can be deletedControl access to instance refresh actionsCreate a service-linked roleControl which service-linked role can be passed (using PassRole) +Control the size of the Amazon EC2 Auto Scaling groups that can be createdControl which tag keys and tag values can be usedControl which Amazon EC2 Auto Scaling groups can be deletedControl which scaling policies can be deletedControl access to instance refresh actionsCreate a service-linked roleControl which service-linked role can be passed (using PassRole) @@ -44 +44 @@ JSON -This sample policy grants permissions to create, update, and delete Auto Scaling groups, but only if the group uses the tag ``purpose=testing``. Because `Describe` actions do not support resource-level permissions, you must specify them in a separate statement without conditions. To launch instances with a launch template, the user must also have the `ec2:RunInstances` permission. For more information, see [Control Amazon EC2 launch template usage in Auto Scaling groups](./ec2-auto-scaling-launch-template-permissions.html). +This sample policy grants permissions to create, update, and delete Amazon EC2 Auto Scaling groups, but only if the group uses the tag ``purpose=testing``. Because `Describe` actions do not support resource-level permissions, you must specify them in a separate statement without conditions. To launch instances with a launch template, the user must also have the `ec2:RunInstances` permission. For more information, see [Control Amazon EC2 launch template usage in Amazon EC2 Auto Scaling groups](./ec2-auto-scaling-launch-template-permissions.html). @@ -50 +50 @@ You can create your own custom IAM policies to allow or deny permissions for IAM -Some Amazon EC2 Auto Scaling API actions allow you to include specific Auto Scaling groups in your policy that can be created or modified by the action. You can restrict the target resources for these actions by specifying individual Auto Scaling group ARNs. As a best practice, however, we recommend that you use tag-based policies that allow (or deny) actions on Auto Scaling groups with a specific tag. +Some Amazon EC2 Auto Scaling API actions allow you to include specific Amazon EC2 Auto Scaling groups in your policy that can be created or modified by the action. You can restrict the target resources for these actions by specifying individual Amazon EC2 Auto Scaling group ARNs. As a best practice, however, we recommend that you use tag-based policies that allow (or deny) actions on Amazon EC2 Auto Scaling groups with a specific tag. @@ -54 +54 @@ Some Amazon EC2 Auto Scaling API actions allow you to include specific Auto Scal - * Control the size of the Auto Scaling groups that can be created + * Control the size of the Amazon EC2 Auto Scaling groups that can be created @@ -58 +58 @@ Some Amazon EC2 Auto Scaling API actions allow you to include specific Auto Scal - * Control which Auto Scaling groups can be deleted + * Control which Amazon EC2 Auto Scaling groups can be deleted @@ -71 +71 @@ Some Amazon EC2 Auto Scaling API actions allow you to include specific Auto Scal -## Control the size of the Auto Scaling groups that can be created +## Control the size of the Amazon EC2 Auto Scaling groups that can be created @@ -73 +73 @@ Some Amazon EC2 Auto Scaling API actions allow you to include specific Auto Scal -The following policy grants permissions to create and update all Auto Scaling groups with the tag ``environment=development``, as long as the requester doesn't specify a minimum size less than `1` or a maximum size greater than `10`. Whenever possible, use tags to help you control access to the Auto Scaling groups in your account. +The following policy grants permissions to create and update all Amazon EC2 Auto Scaling groups with the tag ``environment=development``, as long as the requester doesn't specify a minimum size less than `1` or a maximum size greater than `10`. Whenever possible, use tags to help you control access to the Amazon EC2 Auto Scaling groups in your account. @@ -100 +100 @@ JSON -Alternatively, if you are not using tags to control access to Auto Scaling groups, you can use ARNs to identify the Auto Scaling groups that the IAM policy applies to. +Alternatively, if you are not using tags to control access to Amazon EC2 Auto Scaling groups, you can use ARNs to identify the Amazon EC2 Auto Scaling groups that the IAM policy applies to. @@ -102 +102 @@ Alternatively, if you are not using tags to control access to Auto Scaling group -An Auto Scaling group has the following ARN. +An Amazon EC2 Auto Scaling group has the following ARN. @@ -111 +111 @@ You can also specify multiple ARNs by enclosing them in a list. For more informa -You can also use conditions in your IAM policies to control the tag keys and tag values that can be applied to Auto Scaling groups. To grant permissions to create or tag an Auto Scaling group only if the requester specifies certain tags, use the `aws:RequestTag` condition key. To allow only specific tag keys, use the `aws:TagKeys` condition key with the `ForAllValues` modifier. +You can also use conditions in your IAM policies to control the tag keys and tag values that can be applied to Amazon EC2 Auto Scaling groups. To grant permissions to create or tag an Amazon EC2 Auto Scaling group only if the requester specifies certain tags, use the `aws:RequestTag` condition key. To allow only specific tag keys, use the `aws:TagKeys` condition key with the `ForAllValues` modifier. @@ -138 +138 @@ JSON -The following policy specifies that the requester can only tag Auto Scaling groups with the tags ``purpose=webserver`` and ``cost-center=cc123``, and allows only the ``purpose`` and ``cost-center`` tags (no other tags can be specified). +The following policy specifies that the requester can only tag Amazon EC2 Auto Scaling groups with the tags ``purpose=webserver`` and ``cost-center=cc123``, and allows only the ``purpose`` and ``cost-center`` tags (no other tags can be specified). @@ -196 +196 @@ For conditions, the condition key is not case-sensitive and the condition value -## Control which Auto Scaling groups can be deleted +## Control which Amazon EC2 Auto Scaling groups can be deleted @@ -198 +198 @@ For conditions, the condition key is not case-sensitive and the condition value -The following policy allows deletion of an Auto Scaling group only if the group has the tag ``environment=development``. +The following policy allows deletion of an Amazon EC2 Auto Scaling group only if the group has the tag ``environment=development``. @@ -220 +220 @@ JSON -Alternatively, if you are not using condition keys to control access to Auto Scaling groups, you can specify the ARNs of resources in the `Resource` element to control access instead. +Alternatively, if you are not using condition keys to control access to Amazon EC2 Auto Scaling groups, you can specify the ARNs of resources in the `Resource` element to control access instead. @@ -222 +222 @@ Alternatively, if you are not using condition keys to control access to Auto Sca -The following policy gives users permissions to use the `DeleteAutoScalingGroup` API action, but only for only for Auto Scaling groups whose name begins with ``devteam-``. +The following policy gives users permissions to use the `DeleteAutoScalingGroup` API action, but only for only for Amazon EC2 Auto Scaling groups whose name begins with ``devteam-``. @@ -243 +243 @@ JSON -You can also specify multiple ARNs by enclosing them in a list. Including the UUID ensures that access is granted to the specific Auto Scaling group. The UUID for a new group is different than the UUID for a deleted group with the same name. +You can also specify multiple ARNs by enclosing them in a list. Including the UUID ensures that access is granted to the specific Amazon EC2 Auto Scaling group. The UUID for a new group is different than the UUID for a deleted group with the same name. @@ -254 +254 @@ You can also specify multiple ARNs by enclosing them in a list. Including the UU -The following policy grants permissions to use the `DeletePolicy` action to delete a scaling policy. However, it also denies the action if the Auto Scaling group being acted upon has the tag ``environment=production``. Whenever possible, use tags to help you control access to the Auto Scaling groups in your account. +The following policy grants permissions to use the `DeletePolicy` action to delete a scaling policy. However, it also denies the action if the Amazon EC2 Auto Scaling group being acted upon has the tag ``environment=production``. Whenever possible, use tags to help you control access to the Amazon EC2 Auto Scaling groups in your account. @@ -283 +283 @@ JSON -The following policy grants permission to start, roll back, and cancel an instance refresh only if the Auto Scaling group being acted upon has the tag ``environment=testing``. Because `Describe` actions do not support resource-level permissions, you must specify them in a separate statement without conditions. +The following policy grants permission to start, roll back, and cancel an instance refresh only if the Amazon EC2 Auto Scaling group being acted upon has the tag ``environment=testing``. Because `Describe` actions do not support resource-level permissions, you must specify them in a separate statement without conditions. @@ -316 +316 @@ To specify a desired configuration in the `StartInstanceRefresh` call, users mig - * **ec2:RunInstances** – To launch EC2 instances using a launch template, the user must have the `ec2:RunInstances` permission in an IAM policy. For more information, see [Control Amazon EC2 launch template usage in Auto Scaling groups](./ec2-auto-scaling-launch-template-permissions.html). + * **ec2:RunInstances** – To launch EC2 instances using a launch template, the user must have the `ec2:RunInstances` permission in an IAM policy. For more information, see [Control Amazon EC2 launch template usage in Amazon EC2 Auto Scaling groups](./ec2-auto-scaling-launch-template-permissions.html). @@ -360 +360 @@ JSON -Users who create or update Auto Scaling groups and specify a custom suffix service-linked role in the request require the `iam:PassRole` permission. +Users who create or update Amazon EC2 Auto Scaling groups and specify a custom suffix service-linked role in the request require the `iam:PassRole` permission. @@ -364 +364 @@ You can use the `iam:PassRole` permission to protect the security of your AWS KM -The following policy grants permissions to pass the **`AWSServiceRoleForAutoScaling_devteamkeyaccess`** role to any Auto Scaling group whose name begins with ``devteam-``. If the IAM identity that creates the Auto Scaling group tries to specify a different service-linked role, they receive an error. If they choose not to specify a service-linked role, the default **AWSServiceRoleForAutoScaling** role is used instead. +The following policy grants permissions to pass the **`AWSServiceRoleForAutoScaling_devteamkeyaccess`** role to any Amazon EC2 Auto Scaling group whose name begins with ``devteam-``. If the IAM identity that creates the Amazon EC2 Auto Scaling group tries to specify a different service-linked role, they receive an error. If they choose not to specify a service-linked role, the default **AWSServiceRoleForAutoScaling** role is used instead.