AWS AmazonS3 documentation change
Summary
Clarified IAM Identity Center region requirements and added cross-region replication option
Security assessment
Documents security best practice by enforcing same-region deployment for IAM Identity Center and S3 Access Grants. Added replication guidance maintains access control integrity but doesn't fix vulnerabilities.
Diff
diff --git a/AmazonS3/latest/userguide/access-grants-directory-ids.md b/AmazonS3/latest/userguide/access-grants-directory-ids.md index 19180fa83..ab2627fef 100644 --- a//AmazonS3/latest/userguide/access-grants-directory-ids.md +++ b//AmazonS3/latest/userguide/access-grants-directory-ids.md @@ -17 +17 @@ IAM Identity Center is integrated with AWS Organizations so that you can central -However, if your AWS Organizations administrator hasn't yet configured a central IAM Identity Center instance, you can create a local one in the same account as your S3 Access Grants instance. Such a configuration is more common for proof-of-concept or local development use cases. In all cases, the IAM Identity Center instance must be in the same AWS Region as the S3 Access Grants instance to which it will be associated. +However, if your AWS Organizations administrator hasn't yet configured a central IAM Identity Center instance, you can create a local one in the same account and AWS Region as your S3 Access Grants instance. If you have an IAM Identity Center instance configured in a different AWS Region, you can also [replicate](https://docs.aws.amazon.com/singlesignon/latest/userguide/replicate-to-additional-region.html) this instance to the same AWS Region as your S3 Access Grants instance. Such a configuration is more common for proof-of-concept or local development use cases. In all cases, the IAM Identity Center instance must be in the same AWS Region as the S3 Access Grants instance to which it will be associated.