AWS guardduty documentation change
Summary
Updated IAM policies to include permissions for Malware Protection for AWS Backup and revised policy documentation
Security assessment
The changes add IAM permissions required to enable Malware Protection for AWS Backup, a security feature. While IAM permissions are security-sensitive, there is no evidence this fixes a vulnerability; it enables a new feature.
Diff
diff --git a/guardduty/latest/ug/security-iam-awsmanpol.md b/guardduty/latest/ug/security-iam-awsmanpol.md index 5f87910c8..ea70e9122 100644 --- a//guardduty/latest/ug/security-iam-awsmanpol.md +++ b//guardduty/latest/ug/security-iam-awsmanpol.md @@ -33 +33 @@ The AmazonGuardDutyFullAccess_v2 policy includes the following permissions: - * Allows users to pass a role to GuardDuty that uses this role to enable the GuardDuty Malware Protection for S3 feature. This is regardless of how you enable Malware Protection for S3 \- within the GuardDuty service or independently. + * Allows users to pass a role to GuardDuty. GuardDuty uses this role to enable Malware Protection for S3 and scan S3 objects for malware. GuardDuty also uses this role to initiate scans for Malware Protection for AWS Backup. @@ -70 +70 @@ This policy includes the following permissions. - * Allows users to pass a role to GuardDuty that uses this role to enable the GuardDuty Malware Protection for S3 feature. This is regardless of how you enable Malware Protection for S3 \- within the GuardDuty service or independently. + * Allows users to pass a role to GuardDuty. GuardDuty uses this role to enable Malware Protection for S3 and scan S3 objects for malware. GuardDuty also uses this role to initiate scans for Malware Protection for AWS Backup. @@ -109,0 +110,42 @@ Change | Description | Date +AmazonGuardDutyFullAccess_v2 – Update to an existing policy | Added permission that allows you to pass an IAM role to GuardDuty when you enable Malware Protection for AWS Backup. + + + { + "Sid": "AllowPassRoleToMalwareProtection", + "Effect": "Allow", + "Action": [ + "iam:PassRole" + ], + "Resource": "arn:aws:iam::*:role/*", + "Condition": { + "StringEquals": { + "iam:PassedToService": [ + "malware-protection-plan.guardduty.amazonaws.com", + "malware-protection.guardduty.amazonaws.com" + ] + } + } + } + +| November 19, 2025 +AmazonGuardDutyFullAccess – Update to an existing policy | Added permission that allows you to pass an IAM role to GuardDuty when you enable Malware Protection for AWS Backup. + + + { + "Sid": "AllowPassRoleToMalwareProtection", + "Effect": "Allow", + "Action": [ + "iam:PassRole" + ], + "Resource": "arn:aws:iam::*:role/*", + "Condition": { + "StringEquals": { + "iam:PassedToService": [ + "malware-protection-plan.guardduty.amazonaws.com", + "malware-protection.guardduty.amazonaws.com" + ] + } + } + } + +| November 19, 2025 @@ -112 +154 @@ AmazonGuardDutyFullAccess_v2 – Added a new policy | Added a new AmazonGuardDut -[AmazonGuardDutyServiceRolePolicy](./slr-permissions.html) – Update to an existing policy | Added permission that allows you to pass an IAM role to GuardDuty when you enable Malware Protection for S3. +[AmazonGuardDutyFullAccess](./slr-permissions.html) – Update to an existing policy | Added permission that allows you to pass an IAM role to GuardDuty when you enable Malware Protection for S3. @@ -124 +166 @@ AmazonGuardDutyFullAccess_v2 – Added a new policy | Added a new AmazonGuardDut - "iam:PassedToService": "guardduty.amazonaws.com" + "iam:PassedToService": "malware-protection-plan.guardduty.amazonaws.com"