AWS deadline-cloud medium security documentation change
Summary
Clarified credential requirements for automatic downloads and removed time-bound IAM policy example.
Security assessment
Added explicit warning about using long-term IAM credentials instead of expiring session credentials. Removal of time-bound policy reduces security guidance, but the added credential warning improves security documentation.
Diff
diff --git a/deadline-cloud/latest/userguide/auto-downloads.md b/deadline-cloud/latest/userguide/auto-downloads.md index 1af8415dd..984e38419 100644 --- a//deadline-cloud/latest/userguide/auto-downloads.md +++ b//deadline-cloud/latest/userguide/auto-downloads.md @@ -9 +9 @@ Configure credentialsPrerequisitesTest the output download commandSet up schedul -The Deadline CLI provides a command to download the output of all tasks in a queue that completed since the last time the same command ran. You can configure this as a cron job or scheduled task to run repeatedly. This configuration creates automatic downloading of output on a continuous basis. +The Deadline CLI provides a command to download the output of all tasks in a queue that completed since the last time the same command ran. You can configure this as a cron job or scheduled task to run repeatedly. This configuration sets up automatic downloading of output on a continuous basis. @@ -15 +15 @@ Before setting up automatic downloads, follow the steps in [Storage profiles for -If you want to run the output synchronization command manually, or to understand how it works before configuring it as a cron job, you can use the credentials from logging in to the Deadline Cloud monitor desktop application. +Automatic downloads use the Deadline CLI to continuously download job outputs. To authenticate these downloads, you need long-term IAM credentials. Deadline Cloud monitor credentials expire, so you can't use them for this purpose. @@ -17,5 +17 @@ If you want to run the output synchronization command manually, or to understand -### On-premises AWS credentials - -Your on-premises workers use credentials to access Deadline Cloud job attachments output. For the most secure access, we recommend using IAM Roles Anywhere to authenticate your workers. For more information, see [IAM Roles Anywhere](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html). - -For testing, you can use IAM user access keys for AWS credentials. We recommend that you set an expiration for the IAM user by including a restrictive inline policy. +Follow the steps below to set up long-term credentials. @@ -93,34 +88,0 @@ JSON -###### Restrict user access to a limited time window - -Any IAM user access keys that you create are long-term credentials. To ensure that these credentials expire in case they are mishandled, you can make these credentials time-bound by creating an inline policy that specifies a date after which the keys will no longer be valid. - - 1. Open the IAM user that you just created. In the ****Permissions tab, choose**Add permissions** and then choose **Create inline policy**. - - 2. In the JSON editor, specify the following permissions. To use this policy, replace the `aws:CurrentTime` timestamp value in the example policy with your own time and date. - -JSON - - -**** - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Deny", - "Action": "*", - "Resource": "*", - "Condition": { - "DateGreaterThan": { - "aws:CurrentTime": "2024-01-01T00:00:00Z" - } - } - } - ] - } - - - - -