AWS drs medium security documentation change

Service: drs · 2025-11-22 · Security-related medium

File: drs/latest/userguide/Target-Related-FAQ.md

Summary

Corrected IAM policy resource ARN format for CreateSessionForDrs API action

Security assessment

The ARN change from 'arn:aws:execute-api:<region>::*/POST/CreateSessionForDrs' to 'arn:aws:execute-api:<region>:*.*/POST/CreateSessionForDrs' fixes a potential misconfiguration in the example IAM policy. The original ARN syntax was invalid (empty account ID), which could lead to unintended permissions. The corrected format ensures proper scoping, addressing a security-relevant policy example.

Diff

diff --git a/drs/latest/userguide/Target-Related-FAQ.md b/drs/latest/userguide/Target-Related-FAQ.md
index 070da3ae4..292852efa 100644
--- a//drs/latest/userguide/Target-Related-FAQ.md
+++ b//drs/latest/userguide/Target-Related-FAQ.md
@@ -99 +99 @@ If the AWS replication agents are installed with a principal using [ AWSElasticD
-                    "Resource": "arn:aws:execute-api:<region>::*/POST/CreateSessionForDrs"
+                    "Resource": "arn:aws:execute-api:<region>:*.*/POST/CreateSessionForDrs"