AWS transform medium security documentation change

Service: transform · 2025-12-10 · Security-related medium

File: transform/latest/userguide/security-iam-awsmanpol.md

Summary

Added 3 new AWS managed policies for Transform Custom with detailed permissions

Security assessment

Introduces new IAM policies defining granular permissions (including AWSTransformCustomFullAccess with admin privileges). While not addressing a specific vulnerability, these changes directly document security controls for access management. The AWSTransformCustomFullAccess policy's 'complete administrative access' wording indicates security relevance.

Diff

diff --git a/transform/latest/userguide/security-iam-awsmanpol.md b/transform/latest/userguide/security-iam-awsmanpol.md
index 5b4a10c74..4b90eb282 100644
--- a//transform/latest/userguide/security-iam-awsmanpol.md
+++ b//transform/latest/userguide/security-iam-awsmanpol.md
@@ -5 +5 @@
-UpdatesAWSServiceRoleForAWSTransformAWSTransformApplicationDeploymentPolicyAWSTransformApplicationECSDeploymentPolicy
+UpdatesAWSServiceRoleForAWSTransformAWSTransformApplicationDeploymentPolicyAWSTransformApplicationECSDeploymentPolicyAWSTransformCustomFullAccessAWSTransformCustomExecuteTransformationsAWSTransformCustomManageTransformations
@@ -22,0 +23,3 @@ Change | Description | Date
+AWSTransformCustomFullAccess – New policy |  Added a new AWS managed policy that provides full access to AWS Transform custom. | December 5, 2025  
+AWSTransformCustomExecuteTransformations – New policy |  Added a new AWS managed policy that provides access to execute transformations in AWS Transform custom. | December 5, 2025  
+AWSTransformCustomManageTransformations – New policy |  Added a new AWS managed policy that provides access to create, update, read, and delete transformation resources in AWS Transform custom, as well as execute transformations. | December 5, 2025  
@@ -95,0 +99,57 @@ To view the policy permission details see [AWSTransformApplicationECSDeploymentP
+## AWS managed policy: AWSTransformCustomFullAccess 
+
+This policy provides full access to AWS Transform custom. 
+
+**Description**
+
+This policy includes the following permissions:
+
+  * **AWS Transform Custom** – Allows all actions on all AWS Transform custom resources. This provides complete administrative access to the service.
+
+
+
+
+**Permissions details**
+
+To view the policy permission details see [AWSTransformCustomFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSTransformCustomFullAccess.html) in the AWS Managed Policy Reference Guide.
+
+## AWS managed policy: AWSTransformCustomExecuteTransformations 
+
+This policy provides access to execute transformations in AWS Transform custom. 
+
+**Description**
+
+This policy includes the following permissions:
+
+  * **AWS Transform Custom** – Allows streaming conversations, executing transformations, and managing campaigns. Includes permissions to get campaign details, update campaign repository status, and update campaigns.
+
+
+
+
+**Permissions details**
+
+To view the policy permission details see [AWSTransformCustomExecuteTransformations](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSTransformCustomExecuteTransformations.html) in the AWS Managed Policy Reference Guide.
+
+## AWS managed policy: AWSTransformCustomManageTransformations 
+
+This policy provides access to create, update, read, and delete transformation resources in AWS Transform custom, as well as execute transformations. 
+
+**Description**
+
+This policy includes the following permissions:
+
+  * **AWS Transform Custom** – Allows comprehensive management of transformation resources including streaming conversations, executing transformations, and managing transformation packages. Permits creating, getting, and deleting transformation package URLs and completing package uploads.
+
+  * **Knowledge Management** – Allows listing, getting, deleting, and updating knowledge items and their configurations and status.
+
+  * **Campaign Management** – Allows getting campaign details, updating campaign repository status, and updating campaigns.
+
+  * **Resource Tagging** – Allows listing, adding, and removing tags for AWS Transform custom resources.
+
+
+
+
+**Permissions details**
+
+To view the policy permission details see [AWSTransformCustomManageTransformations](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSTransformCustomManageTransformations.html) in the AWS Managed Policy Reference Guide.
+