AWS fis medium security documentation change
Summary
Added support for Multi-Region strongly consistent (MRSC) global tables in DynamoDB pause replication action, including detailed resource policy examples, quota limitations, and permission requirements. Updated MREC policy structure to use wildcard principal with ARN conditions.
Security assessment
The change implements temporary resource policies with explicit Deny statements and time-bound conditions to restrict DynamoDB replication services during experiments. This prevents unauthorized modifications during fault injection tests and demonstrates secure IAM policy patterns. The explicit Deny policies mitigate risks of unintended table modifications during experiments.
Diff
diff --git a/fis/latest/userguide/fis-actions-reference.md b/fis/latest/userguide/fis-actions-reference.md index d43da0240..a5dc84536 100644 --- a//fis/latest/userguide/fis-actions-reference.md +++ b//fis/latest/userguide/fis-actions-reference.md @@ -286 +286 @@ AWS FIS supports the following Amazon DynamoDB action. -Pauses Amazon DynamoDB multi-Region eventually consistent (MREC) global table replication to any replica table. Tables may continue to be replicated for up to 5 minutes after action begins. +Pauses Amazon DynamoDB multi-Region global table replication to any replica table. Tables may continue to be replicated for up to 5 minutes after action begins. @@ -288 +288,57 @@ Pauses Amazon DynamoDB multi-Region eventually consistent (MREC) global table re -This action does not support multi-Region strongly consistent (MRSC) global tables. For more information see [Consistency modes](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2globaltables_HowItWorks.html#V2globaltables_HowItWorks.consistency-modes), in the Amazon DynamoDB developer guide. +###### Multi-Region strongly consistent (MRSC) global tables + +The following statements will be dynamically appended to the policy for the target DynamoDB MRSC global table: + + + { + "Statement":[ + { + "Sid": "DoNotModifyFisDynamoDbPauseReplicationEXPxxxxxxxxxxxxxxx", + "Effect":"Deny", + "Principal":{ + "AWS": "*" + }, + "Action":[ + "dynamodb:UpdateTable" + ], + "Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/ExampleGlobalTable", + "Condition": { + "DateLessThan": { + "aws:CurrentTime": "2024-04-10T09:51:41.511Z" + }, + "ArnEquals": { + "aws:PrincipalArn": "arn:aws:iam::123456789012:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication" + } + } + }, + { + "Sid": "DoNotModifyFisDynamoDbPauseReplicationEXPxxxxxxxxxxxxxxxForApplicationAutoScaling", + "Effect":"Deny", + "Principal":{ + "AWS": "*" + }, + "Action":[ + "dynamodb:DescribeTable", + "dynamodb:UpdateTable" + ], + "Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/ExampleGlobalTable", + "Condition": { + "DateLessThan": { + "aws:CurrentTime": "2024-04-10T09:51:41.511Z" + }, + "ArnEquals": { + "aws:PrincipalArn": "arn:aws:iam::123456789012:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" + } + } + } + ] + } + + +If a target table does not have any attached resource polices, a resource policy is created for the duration of the experiment, and automatically deleted when the experiment ends. Otherwise, the fault statement is inserted into an existing policy, without any additional modifications to the existing policy statements. The fault statement is then removed from the policy at the end of the experiment. + +Target Amazon DynamoDB MRSC global tables are subject to an additional quota. This quota enforces that no single table may be subject to more than 5,040 minutes of impairment in a 7-day rolling window. + +Only Amazon DynamoDB MRSC global tables in on-demand capacity mode are supported. Tables in provisioned capacity mode are not supported. + +###### Multi-Region eventually consistent (MREC) global tables @@ -299 +355 @@ The following statement will be dynamically appended to the policy for the targe - "AWS":"arn:aws:iam::123456789012:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication" + "AWS": "*" @@ -315,0 +372,3 @@ The following statement will be dynamically appended to the policy for the targe + }, + "ArnEquals": { + "aws:PrincipalArn": "arn:aws:iam::123456789012:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication" @@ -332 +391 @@ The following statement will be dynamically appended to the stream policy for th - "AWS":"arn:aws:iam::123456789012:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication" + "AWS": "*" @@ -342,0 +402,4 @@ The following statement will be dynamically appended to the stream policy for th + }, + "ArnEquals": { + "aws:PrincipalArn": "arn:aws:iam::123456789012:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplication" + } @@ -376,0 +440 @@ If a target table or stream does not have any attached resource polices, a resou + * `dynamodb:InjectError` * @@ -379,0 +444,3 @@ If a target table or stream does not have any attached resource polices, a resou + +* The permission is only required if you are targeting MRSC global tables + @@ -526,0 +594,2 @@ Injects `InsufficientInstanceCapacity` error responses on requests made by the t +For the Auto Scaling LaunchInstances operation, InsufficientInstanceCapacity errors will be returned in the response's `errors` field, but the Auto Scaling group's desired capacity will still be updated, allowing the asynchronous scaling process to potentially launch instances. For broader testing of insufficient capacity handling with LaunchInstances, consider using this action together with aws:ec2:asg-insufficient-instance-capacity-error. +