AWS res medium security documentation change
Summary
Updated IAM role creation instructions with detailed step-by-step guidance, added Windows 10/11 support, and included screenshot references
Security assessment
The change significantly improves IAM role configuration documentation by adding explicit steps for policy creation and trust relationship verification. This directly addresses security risks by ensuring proper IAM permissions are set, preventing overprivileged access to DynamoDB and S3 resources. The detailed policy validation step (step 11) specifically mitigates misconfiguration risks.
Diff
diff --git a/res/archive/release-minus-3/ug/res-ready-ami.md b/res/archive/release-minus-3/ug/res-ready-ami.md index ce7916e73..042f5044e 100644 --- a//res/archive/release-minus-3/ug/res-ready-ami.md +++ b//res/archive/release-minus-3/ug/res-ready-ami.md @@ -5 +5 @@ -Prepare IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES +Prepare an IAM role to access RES environmentCreate EC2 Image Builder componentPrepare your EC2 Image Builder recipeConfigure EC2 Image Builder infrastructureConfigure Image Builder image pipelineRun Image Builder image pipelineRegister a new software stack in RES @@ -15 +15 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ - * Prepare IAM role to access RES environment + * Prepare an IAM role to access RES environment @@ -32 +32 @@ Before you begin, you must [deploy the latest version of RES](./update-the-produ -## Prepare IAM role to access RES environment +## Prepare an IAM role to access RES environment @@ -38 +38 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Trusted relationships include the Amazon EC2 service. + * Trusted relationships that include the Amazon EC2 service. @@ -42 +42 @@ To access the RES environment service from EC2 Image Builder, you must create or - * Custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. + * A custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. @@ -49,6 +49 @@ To access the RES environment service from EC2 Image Builder, you must create or -**Trusted relationship entity:** - -JSON - - -**** + 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** @@ -55,0 +51 @@ JSON + 2. Select **JSON** from the policy editor. @@ -57,14 +53 @@ JSON - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - + 3. Copy and paste the policy shown here into the editor, replacing `us-east-1` with your desired AWS Region, `111122223333` with your AWS account ID, and `{RES-EnvironmentName}` with your RES EnvironmentName where applicable. @@ -112,0 +95,41 @@ JSON + 4. Choose **Next** and provide a name and optional description to complete the policy creation. + + 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. + + 6. Under **Trusted Entity Type** , select **"AWS service"**. + + 7. Select **EC2** in the **Service or use case** drop down. + + 8. In the **Use case** section, select **EC2** , then choose **Next**. + + 9. Search for and then select the name of the policy you previously created. + + 10. Choose **Next** and provide a name and optional description to complete the role creation. + + 11. Select your new role and verify that the Trust relationship matches the following: + +**Trusted relationship entity:** + +JSON + + +**** + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] + } + + + + + @@ -288 +311,3 @@ RES supports the following image operating systems: - * Windows 2019, 2022 (x86) + * Windows Server 2019, 2022 (x86) + + * Windows 10, 11 (x86) @@ -323,0 +349,2 @@ For Linux environments, you must add these components in order with the `aws-cli + + @@ -343,0 +371,2 @@ For Linux environments, you must add these components in order with the `aws-cli + + @@ -362 +391 @@ You can use infrastructure configurations to specify the Amazon EC2 infrastructu - 1. For **IAM role** , enter the role you previously configured in Prepare IAM role to access RES environment. + 1. For **IAM role** , enter the role you previously configured in Prepare an IAM role to access RES environment.