AWS nova-act medium security documentation change
Summary
Updated IAM policy examples and resource ARNs to reflect Nova Act-specific actions and resources (workflow definitions/runs)
Security assessment
The changes correct IAM policy examples to use proper Nova Act service-specific actions and resources. Incorrect IAM policies could lead to privilege escalation or unauthorized access if users followed outdated examples. The update ensures proper security controls are documented for workflow definition and run resources.
Diff
diff --git a/nova-act/latest/userguide/security-iam-service-with-iam.md b/nova-act/latest/userguide/security-iam-service-with-iam.md index 14dfca9c1..0bf1710c1 100644 --- a//nova-act/latest/userguide/security-iam-service-with-iam.md +++ b//nova-act/latest/userguide/security-iam-service-with-iam.md @@ -41 +41 @@ The `Action` element of an IAM identity-based policy describes the specific acti -Policy actions in Amazon Nova Act use the following prefix before the action: `nova-act:`. For example, to grant someone permission to run an Amazon EC2 instance with the Amazon EC2 `RunInstances` API operation, you include the `ec2:RunInstances` action in their policy. Policy statements must include either an `Action` or `NotAction` element. Amazon Nova Act defines its own set of actions that describe tasks that you can perform with this service. +Policy actions in Amazon Nova Act use the following prefix before the action: `nova-act:`. For example, to grant someone permission to create a workflow definition with the Amazon Nova Act `CreateWorkflowDefinition` API operation, you include the `nova-act:CreateWorkflowDefinition` action in their policy. Policy statements must include either an `Action` or `NotAction` element. Amazon Nova Act defines its own set of actions that describe tasks that you can perform with this service. @@ -47,2 +47,2 @@ To specify multiple actions in a single statement, separate them with commas as - "ec2:action1", - "ec2:action2" + "nova-act:CreateWorkflowDefinition", + "nova-act:GetWorkflowDefinition" @@ -51 +51 @@ To specify multiple actions in a single statement, separate them with commas as -You can specify multiple actions using wildcards (*). For example, to specify all actions that begin with the word `Describe`, include the following action: +You can specify multiple actions using wildcards (*). For example, to specify all actions that begin with the word `List`, include the following action: @@ -54 +54 @@ You can specify multiple actions using wildcards (*). For example, to specify al - "Action": "ec2:Describe*" + "Action": "nova-act:List*" @@ -60 +60 @@ The `Resource` element specifies the object or objects to which the action appli -The Amazon EC2 instance resource has the following ARN: +Amazon Nova Act workflow definition resources have the following ARN: @@ -63 +63,6 @@ The Amazon EC2 instance resource has the following ARN: - arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId} + arn:${Partition}:nova-act:${Region}:${Account}:workflow-definition/${WorkflowDefinitionId} + +Amazon Nova Act workflow run resources have the following ARN: + + + arn:${Partition}:nova-act:${Region}:${Account}:workflow-run/${WorkflowRunId} @@ -67 +72,6 @@ For more information about the format of ARNs, see [Amazon Resource Names (ARNs) -For example, to specify the `i-1234567890abcdef0` instance in your statement, use the following ARN: +For example, to specify a specific workflow definition in your statement, use the following ARN: + + + "Resource": "arn:aws:nova-act:us-east-1:123456789012:workflow-definition/my-workflow-123" + +To specify a specific workflow run in your statement, use the following ARN: @@ -70 +80 @@ For example, to specify the `i-1234567890abcdef0` instance in your statement, us - "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" + "Resource": "arn:aws:nova-act:us-east-1:123456789012:workflow-run/a1b2c3d4-e5f6-7890-abcd-ef1234567890" @@ -72 +82 @@ For example, to specify the `i-1234567890abcdef0` instance in your statement, us -To specify all instances that belong to a specific account, use the wildcard (*): +To specify all workflow definitions that belong to a specific account, use the wildcard (*): @@ -75 +85 @@ To specify all instances that belong to a specific account, use the wildcard (*) - "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*" + "Resource": "arn:aws:nova-act:us-east-1:123456789012:workflow-definition/*" @@ -82 +92 @@ Some Amazon Nova Act actions, such as those for creating resources, cannot be pe -Many Amazon EC2 API actions involve multiple resources. For example, `AttachVolume` attaches an Amazon EBS volume to an instance, so an IAM user must have permissions to use the volume and the instance. To specify multiple resources in a single statement, separate the ARNs with commas. +Some Amazon Nova Act API actions may be used across multiple resources. For example, an IAM user may need permissions to access multiple workflow runs. To specify multiple resources in a single statement, separate the ARNs with commas. @@ -86,2 +96,2 @@ Many Amazon EC2 API actions involve multiple resources. For example, `AttachVolu - "resource1", - "resource2" + "arn:aws:nova-act:us-east-1:123456789012:workflow-run/a1b2c3d4-e5f6-7890-abcd-ef1234567890", + "arn:aws:nova-act:us-east-1:123456789012:workflow-run/b2c3d4e5-f6a7-8901-bcde-f12345678901" @@ -98 +108 @@ You can also use placeholder variables when you specify conditions. For example, -Amazon Nova Act defines its own set of condition keys and also supports using some global condition keys. To see all AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the _IAM User Guide_. +Amazon Nova Act does not define any service-specific condition keys. However, you can use standard AWS global condition keys with Amazon Nova Act resources and actions. To see all AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the _IAM User Guide_. @@ -100 +110 @@ Amazon Nova Act defines its own set of condition keys and also supports using so -All Amazon EC2 actions support the `aws:RequestedRegion` and `ec2:Region` condition keys. For more information, see [Example: Restricting access to a specific region](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-region). +Amazon Nova Act actions support the `aws:RequestedRegion` condition key. You can use this condition key to restrict access to Amazon Nova Act operations to specific AWS Regions.