AWS ground-station documentation change
Summary
Removed 'Telemetry Sink Config' documentation including IAM role/policy requirements and telemetry streaming details
Security assessment
Change removes documentation of a feature but shows no evidence of addressing a security vulnerability. No CVE, exploit, or weakness mentioned. Removal of IAM examples reduces exposure of sensitive configuration patterns but isn't tied to a specific security incident.
Diff
diff --git a/ground-station/latest/ug/how-it-works.config.md b/ground-station/latest/ug/how-it-works.config.md index c6f2f6704..c9116055f 100644 --- a//ground-station/latest/ug/how-it-works.config.md +++ b//ground-station/latest/ug/how-it-works.config.md @@ -5 +5 @@ -Tracking ConfigAntenna Downlink ConfigAntenna Downlink Demod Decode Config Antenna Uplink ConfigAntenna Uplink Echo ConfigDataflow Endpoint ConfigAmazon S3 Recording ConfigTelemetry Sink Config +Tracking ConfigAntenna Downlink ConfigAntenna Downlink Demod Decode Config Antenna Uplink ConfigAntenna Uplink Echo ConfigDataflow Endpoint ConfigAmazon S3 Recording Config @@ -9 +9 @@ Tracking ConfigAntenna Downlink ConfigAntenna Downlink Demod Decode Config Anten -_Configs_ are resources that AWS Ground Station uses to define the parameters for each aspect of your contact. Add the configs you want to a mission profile, and then that mission profile will be used when executing the contact. You can define several different types of configs. The configs can be grouped into three categories: +_Configs_ are resources that AWS Ground Station uses to define the parameters for each aspect of your contact. Add the configs you want to a mission profile, and then that mission profile will be used when executing the contact. You can define several different types of configs. The configs can be grouped into two categories: @@ -15,2 +14,0 @@ _Configs_ are resources that AWS Ground Station uses to define the parameters fo - * Telemetry configs - @@ -33,2 +30,0 @@ DataflowEndpointConfig | Source and/or Destination -A _TelemetrySinkConfig_ is the only type of telemetry config. It's used to configure where telemetry data will be delivered during a contact, and is optional in a mission profile. When included, AWS Ground Station streams near real-time telemetry to your account during the execution of your contacts. - @@ -277,61 +272,0 @@ See the following documentation for more information about how to perform operat -## Telemetry Sink Config - -You can use telemetry sink configs to specify where you want telemetry data delivered during satellite contacts. A telemetry sink config is optional and is added to your mission profile to schedule telemetry-enabled contacts. The following specifies restrictions and details about these parameters: - - * The IAM role must have a trust policy that allows the `groundstation.amazonaws.com` service principal to assume the role. See the Example Trust Policy section below for an example. - - - - -For more information on how to update a role's trust policy, see [Managing IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) in the IAM User Guide. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "groundstation.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - - * The IAM role must have an IAM policy that allows the role to perform the `kinesis:DescribeStream`, `kinesis:PutRecord` and `kinesis:PutRecords` actions on the stream. See the Example Role Policy section below for an example. - - - - -For more information on how to update or attach a role policy, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) in the IAM User Guide. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "kinesis:DescribeStream", - "kinesis:PutRecord", - "kinesis:PutRecords" - ], - "Resource": "arn:aws:kinesis:us-east-2:999999999999:stream/your-stream-name" - } - ] - } - -When you include a telemetry sink config in your mission profile, AWS Ground Station will stream telemetry data to your account during contacts. For more information about telemetry types, data format, and setting up the necessary AWS resources, see [Work with telemetry](./telemetry.html). - -See the following documentation for more information about how to perform operations on telemetry sink configs using CloudFormation, the AWS Command Line Interface, or the AWS Ground Station API. - - * [ AWS::GroundStation::Config TelemetrySinkConfig CloudFormation property](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-groundstation-config-telemetrysinkconfig.html) - - * [ Config AWS CLI reference](https://docs.aws.amazon.com/cli/latest/reference/groundstation/create-config.html) (see the `telemetrySinkConfig -> (structure)` section) - - * [ TelemetrySinkConfig API reference](https://docs.aws.amazon.com/ground-station/latest/APIReference/API_TelemetrySinkConfig.html) - - - -