AWS security-ir documentation change
Summary
Expanded permissions for AWSSecurityIncidentResponseServiceRolePolicy to include ListCases, UpdateCase, CreateCaseComment, and ListComments actions for AI-driven security investigations
Security assessment
The changes document expanded permissions for automated security incident response capabilities but do not indicate a security vulnerability being addressed. The additions enhance security documentation by clarifying how AI agents interact with case management systems.
Diff
diff --git a/security-ir/latest/userguide/aws-managed-policies.md b/security-ir/latest/userguide/aws-managed-policies.md index 873b0cdb7..ebd68bc45 100644 --- a//security-ir/latest/userguide/aws-managed-policies.md +++ b//security-ir/latest/userguide/aws-managed-policies.md @@ -36 +36 @@ Additionally, AWS supports managed policies for job functions that span multiple -AWS Security Incident Response uses the AWSSecurityIncidentResponseServiceRolePolicy AWS managed policy. This AWS managed policy is attached to the [AWSServiceRoleForSecurityIncidentResponse](./using-service-linked-roles.html#AWSServiceRoleForSecurityIncidentResponse) service-linked role. The policy provides access for AWS Security Incident Response to identify accounts subscribed, create cases, and tag related resources. +AWS Security Incident Response uses the AWSSecurityIncidentResponseServiceRolePolicy AWS managed policy. This AWS managed policy is attached to the [AWSServiceRoleForSecurityIncidentResponse](./using-service-linked-roles.html#AWSServiceRoleForSecurityIncidentResponse) service-linked role. The policy provides access for AWS Security Incident Response to identify accounts subscribed, create cases, update cases, create case comments, list cases, list case comments, and tag related resources. @@ -49,0 +50,8 @@ The service uses this policy to perform actions on the following resources: + * _ListCases:_ Allows the service’s AI agent to view cases for the purposes of security investigation. + + * _UpdateCase:_ Allows the service’s AI agent to update case metadata. + + * _CreateCaseComment:_ Allows the service’s AI agent to post its results as a case comment. + + * _ListComments:_ Allows the service’s AI agent to view case comments needed to perform automated investigations. + @@ -148,0 +157 @@ Change | Description | Date +Updated – AWSSecurityIncidentResponseServiceRolePolicy | The policy now performs actions on the following resources: ListCases: Allows the service’s AI agent to view cases for the purposes of security investigation UpdateCase: Allows the service’s AI agent to update case metadata. CreateCaseComment: Allows the service’s AI agent to post its results as a case comment ListComments: Allows the service’s AI agent to view case comments needed to perform automated investigations | TBD