AWS detective documentation change
Summary
Updated documentation for Detective's finding group summary feature to introduce cross-region inference, provide opt-out mechanisms (user-level and IAM-based), and clarify future region selection behavior.
Security assessment
The changes document security controls (IAM deny policies for detective:InvokeAssistant) to prevent cross-region data processing and emphasize encryption during transit. However, there's no evidence of addressing a specific existing vulnerability - rather, it proactively documents upcoming feature changes and opt-out mechanisms.
Diff
diff --git a/detective/latest/userguide/finding-group-summary.md b/detective/latest/userguide/finding-group-summary.md index af9bf81e7..d187fea7d 100644 --- a//detective/latest/userguide/finding-group-summary.md +++ b//detective/latest/userguide/finding-group-summary.md @@ -5 +5 @@ -Reviewing finding group summaryDisabling finding group summaryEnabling finding group summarySupported Regions +Reviewing finding group summaryOpting out of finding group summaryEnabling finding group summaryCross-region inferenceSupported Regions @@ -10,0 +11,6 @@ By default, Amazon Detective automatically provides summaries of an individual f +###### Note + +Beginning February 16th, 2026, Detective's Finding Group Summary feature will automatically select the optimal AWS region (from a grouping of regional endpoints within your geography) to process your finding group data and generate summaries using Cross-region inference. + +If you do not wish to use this feature, you can disable it from Detective's console or by using deny permissions on the IAM role used to access Detective's console. See Opting out of finding group summary. + @@ -40 +46,3 @@ If you provide feedback about the finding group summary, your feedback is not us -## Disabling finding group summary +## Opting out of finding group summary + +By default, finding group summary is enabled for finding groups. Customers who do not wish to use the finding group summary feature can opt out at the user level, or via the IAM role being used to access the AWS Management Console. @@ -42 +50 @@ If you provide feedback about the finding group summary, your feedback is not us -By default, finding group summary is enabled for finding groups. You can disable finding group summary at any time. If you disable, you can enable them again later. +### User-level opt-out @@ -44 +52,3 @@ By default, finding group summary is enabled for finding groups. You can disable -###### To disable finding group summary +Each user accessing Detective can set their individual preference to opt out of the finding group summary feature. Opting out of the summary will prevent the finding group data from being processed via cross-region inference. + +###### To opt out of finding group summary @@ -58,0 +69,13 @@ By default, finding group summary is enabled for finding groups. You can disable +### IAM role-based opt-out + +Multiple users can be opted out of the finding group summary feature by modifying the IAM role being used to access Detective. Adding a Deny statement for the `detective:InvokeAssistant` permission on the role will prevent all users accessing Detective via that role from using the finding group summary feature, preventing the processing of finding group data via cross-region inference. Users can then individually follow the user-level opt-out steps to prevent the summary pane from appearing. + +###### To opt out of finding group summary using IAM + + 1. Identify the IAM roles being used for accessing Amazon Detective. + + 2. Add an IAM policy statement with the `Deny` effect for the `detective:InvokeAssistant` action to the role. + + + + @@ -61 +84 @@ By default, finding group summary is enabled for finding groups. You can disable -If you previously disabled finding group summary for finding groups, you can enable them again at any time. +If you previously opted out of finding group summary for finding groups, you can enable them again at any time. @@ -77,0 +101,13 @@ If you previously disabled finding group summary for finding groups, you can ena +## Cross-region inference + +Detective automatically selects the optimal AWS Region within your geography to process your finding group data and generate summaries. This maximizes available compute resources, model availability, and delivers the best customer experience. Your finding group data remains stored only in the Region where the summary request originates, however, finding group data and summary results may be processed outside that Region. All data is transmitted encrypted across Amazon's secure network. + +Detective securely routes your inference requests to available compute resources within the geographic area where the request originated, as shown in the following table. + +Cross-region inference routing Supported Detective geography | Detective Regions | Inference Regions +---|---|--- +United States | us-east-1 | us-east-1, us-east-2, us-west-1, us-west-2 +us-west-2 | us-east-1, us-east-2, us-west-1, us-west-2 +Europe | eu-central-1 | eu-central-1, eu-central-2, eu-north-1, eu-south-1, eu-south-2, eu-west-1, eu-west-2, eu-west-3 +Japan | ap-northeast-1 | ap-northeast-1, ap-northeast-3 +