AWS signin medium security documentation change
Summary
Added documentation note explaining that the managed policy grants permissions for both same-device and cross-device authentication, including resource ARNs for each method, with guidance on creating custom policies to control access.
Security assessment
The change explicitly documents security implications of authentication methods and provides guidance for controlling access through custom policies, directly addressing least privilege security principles.
Diff
diff --git a/signin/latest/userguide/security-iam-awsmanpol.md b/signin/latest/userguide/security-iam-awsmanpol.md index 381903d31..069339201 100644 --- a//signin/latest/userguide/security-iam-awsmanpol.md +++ b//signin/latest/userguide/security-iam-awsmanpol.md @@ -81,0 +82,13 @@ This policy includes the following permissions: +###### Note + +Adding this AWS managed policy gives you permission for both same-device and cross-device authentication. This policy authorizes actions on the following resources: + + * `arn:aws:signin:`region`:`account-id`:oauth2/public-client/localhost` – Used for same-device authentication with `aws login`. + + * `arn:aws:signin:`region`:`account-id`:oauth2/public-client/remote` – Used for cross-device authentication with `aws login --remote`. + + + + +To control access to either authentication method, you can create your own managed policy or service control policy (SCP). Use these resource ARNs to allow or deny programmatic access to AWS using your console credentials. +