AWS msk documentation change
Summary
Added IPv6-related permissions to service-linked role documentation, updated policy reference link, and removed verbose JSON example.
Security assessment
The change explicitly documents new IPv6 networking permissions (assign/unassign IPv6 addresses and modify network interfaces) which relate to network security configuration. However, this is a feature enhancement rather than a security fix. The permission additions help customers understand security controls but don't patch any vulnerability.
Diff
diff --git a/msk/latest/developerguide/slr-permissions.md b/msk/latest/developerguide/slr-permissions.md index feb139fc9..42b50bba0 100644 --- a//msk/latest/developerguide/slr-permissions.md +++ b//msk/latest/developerguide/slr-permissions.md @@ -16,0 +17 @@ Amazon MSK uses the service-linked role named **AWSServiceRoleForKafka**. Amazon + * `*Ipv6Addresses` – assign and unassign IPv6 addresses to network interfaces in customer account to enable IPv6 connectivity for MSK clusters. @@ -17,0 +19 @@ Amazon MSK uses the service-linked role named **AWSServiceRoleForKafka**. Amazon + * `ModifyNetworkInterfaceAttribute` – modify network interface attributes in customer account to configure IPv6 settings for MSK cluster connectivity. @@ -20 +22,3 @@ Amazon MSK uses the service-linked role named **AWSServiceRoleForKafka**. Amazon -This service-linked role is attached to the following managed policy: `KafkaServiceRolePolicy`. For updates to this policy, see [KafkaServiceRolePolicy](https://docs.aws.amazon.com/msk/latest/developerguide/security-iam-awsmanpol.html#security-iam-awsmanpol-KafkaServiceRolePolicy). + + +This service-linked role is attached to the following managed policy: `KafkaServiceRolePolicy`. For updates to this policy, see [KafkaServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/KafkaServiceRolePolicy.html). @@ -31,67 +34,0 @@ The role permissions policy allows Amazon MSK to complete the following actions -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "ec2:CreateNetworkInterface", - "ec2:DescribeNetworkInterfaces", - "ec2:CreateNetworkInterfacePermission", - "ec2:AttachNetworkInterface", - "ec2:DeleteNetworkInterface", - "ec2:DetachNetworkInterface", - "ec2:DescribeVpcEndpoints", - "acm-pca:GetCertificateAuthorityCertificate", - "secretsmanager:ListSecrets" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "ec2:ModifyVpcEndpoint" - ], - "Resource": "arn:*:ec2:*:*:subnet/*" - }, - { - "Effect": "Allow", - "Action": [ - "ec2:DeleteVpcEndpoints", - "ec2:ModifyVpcEndpoint" - ], - "Resource": "arn:*:ec2:*:*:vpc-endpoint/*", - "Condition": { - "StringEquals": { - "ec2:ResourceTag/AWSMSKManaged": "true" - }, - "StringLike": { - "ec2:ResourceTag/ClusterArn": "*" - } - } - }, - { - "Effect": "Allow", - "Action": [ - "secretsmanager:GetResourcePolicy", - "secretsmanager:PutResourcePolicy", - "secretsmanager:DeleteResourcePolicy", - "secretsmanager:DescribeSecret" - ], - "Resource": "*", - "Condition": { - "ArnLike": { - "secretsmanager:SecretId": "arn:*:secretsmanager:*:*:secret:AmazonMSK_*" - } - } - } - ] - } - -