AWS AmazonS3 documentation change
Summary
Updated IAM role creation documentation for S3 Batch Operations to clarify role creation constraints and add permissions reference
Security assessment
Changes refine IAM policy documentation by specifying role creation constraints (filter/replication-based object lists) and adding a link to required permissions. While security-related, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/batch-ops-iam-role-policies.md b/AmazonS3/latest/userguide/batch-ops-iam-role-policies.md index 9cd423b89..cf8cc677c 100644 --- a//AmazonS3/latest/userguide/batch-ops-iam-role-policies.md +++ b//AmazonS3/latest/userguide/batch-ops-iam-role-policies.md @@ -26 +26 @@ Amazon S3 must have permissions to perform S3 Batch Operations on your behalf. Y -If you choose to let Amazon S3 create the IAM role for you, it automatically creates and attaches trust and permissions policies to the role. The trust policy allows the S3 Batch Operations service principal (`batchoperations.s3.amazonaws.com`) to assume the role. The permissions policy is an [AWS managed policy](./security-iam-awsmanpol.html) that includes all the requisite actions for running the job, based on the settings that you specify for the job. For example, if you configure a job to copy objects from one bucket to another bucket in your AWS account, the permissions policy allows actions such as `s3:GetObject` and `s3:PutObject`. You can review the trust and permissions policies for the role before you submit the job. This option is available only if you use the Amazon S3 console to create a job. After you submit the job, the IAM role persists in your account. You can then use it again for subsequent jobs that perform the same operation, or delete it when the job finishes running. +If you choose to let Amazon S3 create the IAM role for you, it automatically creates and attaches trust and permissions policies to the role. The trust policy allows the S3 Batch Operations service principal (`batchoperations.s3.amazonaws.com`) to assume the role. The permissions policy allows all the requisite actions for running the job, based on the settings that you specify for the job. For example, if you configure a job to copy objects from one bucket to another bucket in your AWS account, the permissions policy allows actions such as `s3:GetObject` and `s3:PutObject`. You can review the trust and permissions policies for the role before you submit the job. This option is available only if you use the Amazon S3 console to create a job, and you configure the job to use an S3 generated object list that uses filters or is based on a replication configuration. After you submit the job, the IAM role persists in your account. You can then use it again for subsequent jobs that perform the same operation, or delete it when the job finishes running. @@ -28,5 +28 @@ If you choose to let Amazon S3 create the IAM role for you, it automatically cre -###### Note - -You can choose to let Amazon S3 create the IAM role for you for jobs that use an S3 generated object list with filters, or jobs that use an object list based on a replication configuration. - -If you prefer to create the IAM role manually, the policy examples in this section can help you create the role. For more information about creating and configuring roles, see [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the _IAM User Guide_. For additional examples, see [Controlling permissions for Batch Operations using job tags](./batch-ops-job-tags-examples.html) and [Copying objects using S3 Batch Operations](./batch-ops-examples-copy.html). +If you prefer to create the IAM role manually, the policy examples in this section can help you create the role. For more information about creating and configuring roles, see [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the _IAM User Guide_. For information about permissions for S3 API operations by S3 resource type, see [Required permissions for Amazon S3 API operations](./using-with-s3-policy-actions.html). For additional examples, see [Controlling permissions for Batch Operations using job tags](./batch-ops-job-tags-examples.html) and [Copying objects using S3 Batch Operations](./batch-ops-examples-copy.html). @@ -36,3 +32 @@ In your IAM policies, you can also use condition keys to filter access permissio -For more information about permissions for S3 API operations by S3 resource type, see [Required permissions for Amazon S3 API operations](./using-with-s3-policy-actions.html). - -The following video includes how to set up IAM permissions for Batch Operations jobs using the AWS Management Console. +The following video includes how to set up IAM permissions for Batch Operations jobs by using the AWS Management Console.