AWS securityhub medium security documentation change
Summary
Updated cost estimator documentation to reflect auto-population of data for Delegated Administrator and Member accounts via cross-account roles, added IAM permission requirements, and included a new section on cross-account access setup.
Security assessment
The changes introduce cross-account IAM role requirements (iam:GetRole, sts:AssumeRole) and explicitly document security configuration for account access patterns. This addresses security implications of improper cross-account access by emphasizing required role setup, making it security-related documentation.
Diff
diff --git a/securityhub/latest/userguide/security-hub-cost-estimator.md b/securityhub/latest/userguide/security-hub-cost-estimator.md index 6c06db990..c1a416e22 100644 --- a//securityhub/latest/userguide/security-hub-cost-estimator.md +++ b//securityhub/latest/userguide/security-hub-cost-estimator.md @@ -39 +39 @@ Key benefits of the cost estimator include: -For Delegated Administrator and Member accounts, the cost estimator opens in edit mode by default, allowing you to immediately enter usage data. Management Account and Standalone accounts open in view mode when Cost Explorer data is available. +For Delegated administrator and member accounts, the cost estimator opens in edit mode by default, allowing you to immediately enter usage data. Management account and standalone accounts open in view mode when Cost Explorer data is available. @@ -41 +41 @@ For Delegated Administrator and Member accounts, the cost estimator opens in edi -This feature automatically retrieves information on actual past usage to estimate the cost for certain account types. The estimator also provides sample data that you can update, in the absence of actual past usage data. See below for details on each of the account types and the data that is available for each account type. +This feature automatically retrieves information on actual past usage to estimate the cost for certain account types. See below for details on each of the account types and the data that is available for each account type. @@ -46,2 +46,2 @@ Management Account (MA) | Auto-populated | Manual override available | Organizat -Delegated Administrator (DA) | Not available | Manual entry only | Manual entry only -Member Account | Not available | Manual entry only | Manual entry only +Delegated Administrator (DA) | Auto-populated via cross-account role* | Manual override available | Organization-wide +Member Account | Auto-populated via cross-account role* | Manual override available | Organization-wide @@ -49,0 +50,2 @@ Standalone Account (SA) | Auto-populated | Manual override available | Single ac +* Requires cross-account IAM role configuration in management account. See [Setting up cross-account access](./setting-up-cross-account-access.html) section below. + @@ -62,0 +65,6 @@ Required IAM permissions for Cost Estimator API Operation | Service | Purpose +`iam:GetRole` | IAM | Check cross-account role existence (Management account only)* +`sts:AssumeRole` | IAM | Assume cross-account role (Delegated administrator/Member account only)** + +* Required only for Management Account users to verify cross-account role status. + +** Required only for Delegated Administrator and Organization Member accounts using cross-account access. @@ -109 +117 @@ Concepts -Using the cost estimator +Setting up cross-account access